/merge`.
diff --git a/data/reusables/actions/single-cpu-table-row.md b/data/reusables/actions/single-cpu-table-row.md
index 3a7de45e91f5..6c86a8dfa9b2 100644
--- a/data/reusables/actions/single-cpu-table-row.md
+++ b/data/reusables/actions/single-cpu-table-row.md
@@ -5,6 +5,6 @@
| 14 GB |
x64 |
- ubuntu-slim ({% data variables.release-phases.public_preview %})
+ ubuntu-slim
|
diff --git a/data/reusables/actions/supported-github-runners.md b/data/reusables/actions/supported-github-runners.md
index 8cfb8859e219..50413dde65bf 100644
--- a/data/reusables/actions/supported-github-runners.md
+++ b/data/reusables/actions/supported-github-runners.md
@@ -108,7 +108,7 @@ For {% ifversion ghec %}internal and{% endif %} private repositories, jobs using
| Linux |
2 |
- 7 GB |
+ 8 GB |
14 GB |
x64 |
@@ -120,7 +120,7 @@ For {% ifversion ghec %}internal and{% endif %} private repositories, jobs using
|
| Windows |
2 |
- 7 GB |
+ 8 GB |
14 GB |
x64 |
@@ -129,6 +129,27 @@ For {% ifversion ghec %}internal and{% endif %} private repositories, jobs using
windows-2022
|
+
+ | Linux |
+ 2 |
+ 8 GB |
+ 14 GB |
+ arm64 |
+
+ ubuntu-24.04-arm,
+ ubuntu-22.04-arm
+ |
+
+
+ | Windows |
+ 2 |
+ 8 GB |
+ 14 GB |
+ arm64 |
+
+ windows-11-arm
+ |
+
| macOS |
4 |
diff --git a/data/reusables/actions/workflow-templates-metadata-example.md b/data/reusables/actions/workflow-templates-metadata-example.md
new file mode 100644
index 000000000000..0f2a52a7711f
--- /dev/null
+++ b/data/reusables/actions/workflow-templates-metadata-example.md
@@ -0,0 +1,15 @@
+```json copy
+{
+ "name": "Octo Organization Workflow",
+ "description": "Octo Organization CI workflow template.",
+ "iconName": "example-icon",
+ "categories": [
+ "Go"
+ ],
+ "filePatterns": [
+ "package.json$",
+ "^Dockerfile",
+ ".*\\.md$"
+ ]
+}
+```
diff --git a/data/reusables/actions/workflow-templates-metadata-keys.md b/data/reusables/actions/workflow-templates-metadata-keys.md
new file mode 100644
index 000000000000..c691f2d5d55e
--- /dev/null
+++ b/data/reusables/actions/workflow-templates-metadata-keys.md
@@ -0,0 +1,11 @@
+* `name` - **Required.** The name of the workflow. This is displayed in the list of available workflows.
+* `description` - **Required.** The description of the workflow. This is displayed in the list of available workflows.
+* `iconName` - **Optional.** Specifies an icon for the workflow that is displayed in the list of workflows. `iconName` can be one of the following types:
+ * An SVG file that is stored in the `workflow-templates` directory. To reference a file, the value must be the file name without the file extension. For example, an SVG file named `example-icon.svg` is referenced as `example-icon`.
+ * An icon from {% data variables.product.prodname_dotcom %}'s set of [Octicons](https://primer.style/octicons/). To reference an octicon, the value must be `octicon `. For example, `octicon smiley`.
+* `categories` - **Optional.** Defines the categories that the workflow is shown under. You can use category names from the following lists:
+ * General category names from the [starter-workflows](https://github.com/actions/starter-workflows/blob/main/README.md#categories) repository.
+ * Linguist languages from the list in the [linguist](https://github.com/github-linguist/linguist/blob/main/lib/linguist/languages.yml) repository.
+ * Supported tech stacks from the list in the [starter-workflows](https://github.com/github-starter-workflows/repo-analysis-partner/blob/main/tech_stacks.yml) repository.
+
+* `filePatterns` - **Optional.** Allows the workflow to be used if the user's repository has a file in its root directory that matches a defined regular expression.
diff --git a/data/reusables/apps/oauth-app-access-restrictions.md b/data/reusables/apps/oauth-app-access-restrictions.md
index b6da84930079..6e51b828e100 100644
--- a/data/reusables/apps/oauth-app-access-restrictions.md
+++ b/data/reusables/apps/oauth-app-access-restrictions.md
@@ -1 +1 @@
-When {% data variables.product.prodname_oauth_app %} access restrictions are enabled, organization members and outside collaborators cannot authorize {% data variables.product.prodname_oauth_app %} access to organization resources. Organization members can request owner approval for {% data variables.product.prodname_oauth_apps %} they'd like to use, and organization owners receive a notification of pending requests.
+When {% data variables.product.prodname_oauth_app %} access restrictions are enabled, organization members and outside collaborators cannot authorize {% data variables.product.prodname_oauth_app %} access to organization resources. Users can request owner approval for {% data variables.product.prodname_oauth_apps %} they'd like to use, and organization owners receive a notification of pending requests.
diff --git a/data/reusables/apps/repo-admin-install-restriction.md b/data/reusables/apps/repo-admin-install-restriction.md
new file mode 100644
index 000000000000..ae7d071eae5f
--- /dev/null
+++ b/data/reusables/apps/repo-admin-install-restriction.md
@@ -0,0 +1 @@
+Repository admins can install {% data variables.product.prodname_github_apps %} in the organization that owns the repository if the app does not request any organization permissions nor the "repository administration" permission. When doing so, they can only install the app with access to the repositories that they admin. {% ifversion fpt or ghec or ghes > 3.19 %}Organization owners can restrict {% data variables.product.prodname_github_app %} installation by repository admins. When this restriction is enabled, repository admins cannot install {% data variables.product.prodname_github_apps %} and must instead request that organization owners install the desired app. For more information, see [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests).{% endif %}
\ No newline at end of file
diff --git a/data/reusables/billing/access-billing-sidebar.md b/data/reusables/billing/access-billing-sidebar.md
new file mode 100644
index 000000000000..1295334b8c9e
--- /dev/null
+++ b/data/reusables/billing/access-billing-sidebar.md
@@ -0,0 +1 @@
+1. In the "Access" section of the sidebar, click **{% octicon "credit-card" aria-hidden="true" aria-label="credit-card" %} Billing and licensing**.
diff --git a/data/reusables/billing/access-org-or-ent-page.md b/data/reusables/billing/access-org-or-ent-page.md
new file mode 100644
index 000000000000..12321d4c5df9
--- /dev/null
+++ b/data/reusables/billing/access-org-or-ent-page.md
@@ -0,0 +1,3 @@
+1. Click **{% octicon "credit-card" aria-hidden="true" aria-label="credit-card" %} Billing & Licensing** to display the billing and licensing overview for the account:
+ * **Organization** accounts: under "Access" in the sidebar for settings.
+ * **Enterprise** accounts: a separate tab at the top of the page.
diff --git a/data/reusables/billing/actions-standard-runner-prices.md b/data/reusables/billing/actions-standard-runner-prices.md
new file mode 100644
index 000000000000..93080551d8d9
--- /dev/null
+++ b/data/reusables/billing/actions-standard-runner-prices.md
@@ -0,0 +1,6 @@
+| Operating system | Billing SKU | Per-minute rate (USD) |
+| ------------------------------------ | -------------| ----------------------|
+| Linux 1-core | `linux_slim` | $0.002 |
+| Linux 2-core | `linux` | $0.006 |
+| Windows 2-core | `windows` | $0.010 |
+| macOS 3-core or 4-core (M1 or Intel) | `macos` | $0.062 |
diff --git a/data/reusables/billing/azure-accept-permissions.md b/data/reusables/billing/azure-accept-permissions.md
new file mode 100644
index 000000000000..618a504831a9
--- /dev/null
+++ b/data/reusables/billing/azure-accept-permissions.md
@@ -0,0 +1 @@
+1. Review the "Permissions requested" prompt. If you agree with the terms, click **Accept**.
diff --git a/data/reusables/billing/azure-select-subscription.md b/data/reusables/billing/azure-select-subscription.md
new file mode 100644
index 000000000000..e6f8947c9970
--- /dev/null
+++ b/data/reusables/billing/azure-select-subscription.md
@@ -0,0 +1 @@
+1. Under "Select a subscription", select the Azure Subscription ID that you want to connect to your account.
diff --git a/data/reusables/billing/budget-create-button.md b/data/reusables/billing/budget-create-button.md
new file mode 100644
index 000000000000..88c4321b942c
--- /dev/null
+++ b/data/reusables/billing/budget-create-button.md
@@ -0,0 +1 @@
+1. Click **Create budget**.
diff --git a/data/reusables/billing/click-licensing.md b/data/reusables/billing/click-licensing.md
new file mode 100644
index 000000000000..ab35c6a61175
--- /dev/null
+++ b/data/reusables/billing/click-licensing.md
@@ -0,0 +1 @@
+1. From the list of "Billing & licensing" pages, click **Licensing**.
diff --git a/data/reusables/billing/click-payment-info.md b/data/reusables/billing/click-payment-info.md
new file mode 100644
index 000000000000..32b8257b4fc8
--- /dev/null
+++ b/data/reusables/billing/click-payment-info.md
@@ -0,0 +1 @@
+1. From the list of "Billing & licensing" pages, click **Payment information**.
diff --git a/data/reusables/billing/client-billing-yearly.md b/data/reusables/billing/client-billing-yearly.md
new file mode 100644
index 000000000000..432dc32aa386
--- /dev/null
+++ b/data/reusables/billing/client-billing-yearly.md
@@ -0,0 +1 @@
+1. Under "How often do you want to be billed?", select **Pay yearly**.
diff --git a/data/reusables/billing/cost-center-click-new.md b/data/reusables/billing/cost-center-click-new.md
new file mode 100644
index 000000000000..76f105c80a1a
--- /dev/null
+++ b/data/reusables/billing/cost-center-click-new.md
@@ -0,0 +1,2 @@
+1. Click **Cost centers**.
+1. Click **New cost center** in the upper-right corner.
diff --git a/data/reusables/billing/cost-center-create-button.md b/data/reusables/billing/cost-center-create-button.md
new file mode 100644
index 000000000000..ffc82f75dc75
--- /dev/null
+++ b/data/reusables/billing/cost-center-create-button.md
@@ -0,0 +1 @@
+1. Click **Create cost center**.
diff --git a/data/reusables/billing/display-usage-view.md b/data/reusables/billing/display-usage-view.md
new file mode 100644
index 000000000000..846b1601e410
--- /dev/null
+++ b/data/reusables/billing/display-usage-view.md
@@ -0,0 +1 @@
+1. In the left sidebar, click **Usage** . For enterprises, then click **Metered usage**.
diff --git a/data/reusables/billing/enterprise-create-button.md b/data/reusables/billing/enterprise-create-button.md
new file mode 100644
index 000000000000..c6b91936ff72
--- /dev/null
+++ b/data/reusables/billing/enterprise-create-button.md
@@ -0,0 +1 @@
+1. Click **Create your enterprise**.
diff --git a/data/reusables/billing/ghas-site-admin-committers.md b/data/reusables/billing/ghas-site-admin-committers.md
new file mode 100644
index 000000000000..f3909e2a0bf6
--- /dev/null
+++ b/data/reusables/billing/ghas-site-admin-committers.md
@@ -0,0 +1,2 @@
+1. In the upper-right corner of any page, click {% octicon "rocket" aria-label="Site admin" %} to display the "Site admin" pages.
+1. In the left sidebar, click **Advanced Security Committers**. If this option is not displayed, at the top of the page, click {% octicon "rocket" aria-hidden="true" aria-label="Site admin" %} **Site admin** to show the top-level "Site admin" page.
diff --git a/data/reusables/billing/marketplace-find-app-downgrade.md b/data/reusables/billing/marketplace-find-app-downgrade.md
new file mode 100644
index 000000000000..cb7cb8b551fb
--- /dev/null
+++ b/data/reusables/billing/marketplace-find-app-downgrade.md
@@ -0,0 +1,3 @@
+1. In the "Marketplace apps" tab, find the app you want to downgrade.
+1. Next to the organization where you want to downgrade the app, select **{% octicon "kebab-horizontal" aria-label="More" %}** and then click **Change plan**.
+1. Select the **Edit your plan** dropdown and click an account's plan to edit.
diff --git a/data/reusables/billing/marketplace-find-app-upgrade.md b/data/reusables/billing/marketplace-find-app-upgrade.md
new file mode 100644
index 000000000000..c6235c264e99
--- /dev/null
+++ b/data/reusables/billing/marketplace-find-app-upgrade.md
@@ -0,0 +1,3 @@
+1. In the "Marketplace apps" tab, find the app you want to upgrade.
+1. Next to the organization where you want to upgrade the app, select **{% octicon "kebab-horizontal" aria-label="More" %}** and then click **Change plan**.
+1. Select the **Edit your plan** dropdown and click an account's plan to edit.
diff --git a/data/reusables/billing/nav-to-ent.md b/data/reusables/billing/nav-to-ent.md
new file mode 100644
index 000000000000..dd66b3dfc0b4
--- /dev/null
+++ b/data/reusables/billing/nav-to-ent.md
@@ -0,0 +1 @@
+1. Navigate to your enterprise. For example, from [https://github.com/settings/enterprises](https://github.com/settings/enterprises?ref_product=ghec&ref_type=engagement&ref_style=text).
diff --git a/data/reusables/billing/nav-to-org-or-ent.md b/data/reusables/billing/nav-to-org-or-ent.md
new file mode 100644
index 000000000000..cd614ff6caf6
--- /dev/null
+++ b/data/reusables/billing/nav-to-org-or-ent.md
@@ -0,0 +1 @@
+1. Navigate to your organization or enterprise. For example, from [https://github.com/settings/organizations](https://github.com/settings/organizations?ref_product=github&ref_type=engagement&ref_style=text) or [https://github.com/settings/enterprises](https://github.com/settings/enterprises?ref_product=ghec&ref_type=engagement&ref_style=text).
diff --git a/data/reusables/billing/premium-request-analytics-start.md b/data/reusables/billing/premium-request-analytics-start.md
index 94ebd042fbf4..c052161099ae 100644
--- a/data/reusables/billing/premium-request-analytics-start.md
+++ b/data/reusables/billing/premium-request-analytics-start.md
@@ -1,2 +1,8 @@
> [!NOTE]
> Premium request analytics data are available from **August 1, 2025** onward. Separate usage data for features that use premium requests is available from **November 1, 2025** for {% data variables.product.prodname_copilot_short %}, {% data variables.product.prodname_spark_short %}, and {% data variables.copilot.copilot_coding_agent %}.
+
+
+User-level analytics have different access permissions depending on your role.
+
+* Enterprise owners and billing managers can see premium request analytics by user.
+* Organization owners cannot view premium request analytics by user or use the `user` parameter in the API. To view user-level usage, these users can download a premium request usage report. See [AUTOTITLE](/billing/how-tos/products/view-productlicense-use#downloading-usage-reports).
diff --git a/data/reusables/cli/preview-note-cli-body.md b/data/reusables/cli/preview-note-cli-body.md
new file mode 100644
index 000000000000..7afa16d21ed5
--- /dev/null
+++ b/data/reusables/cli/preview-note-cli-body.md
@@ -0,0 +1 @@
+{% data variables.copilot.copilot_cli %} is in {% data variables.release-phases.public_preview_dpa %} and subject to change.
diff --git a/data/reusables/cli/preview-note-cli.md b/data/reusables/cli/preview-note-cli.md
index ef76aad76946..8e0fabee84ba 100644
--- a/data/reusables/cli/preview-note-cli.md
+++ b/data/reusables/cli/preview-note-cli.md
@@ -1,2 +1,2 @@
> [!NOTE]
-> {% data variables.copilot.copilot_cli %} is in {% data variables.release-phases.public_preview_dpa %} and subject to change.
+> {% data reusables.cli.preview-note-cli-body %}
diff --git a/data/reusables/code-quality/codeql-query-tables/csharp.md b/data/reusables/code-quality/codeql-query-tables/csharp.md
new file mode 100644
index 000000000000..eba44234ce4d
--- /dev/null
+++ b/data/reusables/code-quality/codeql-query-tables/csharp.md
@@ -0,0 +1,77 @@
+{% rowheaders %}
+
+| Query name | Category | Severity |
+| --- | --- | --- |
+| [Block code with a single Response.Write()](https://codeql.github.com/codeql-query-help/csharp/cs-asp-response-write/) | Maintainability | Recommendation |
+| [Call to obsolete method](https://codeql.github.com/codeql-query-help/csharp/cs-call-to-obsolete-method/) | Maintainability | Warning |
+| [Class has same name as super class](https://codeql.github.com/codeql-query-help/csharp/cs-class-name-matches-base-class/) | Maintainability | Recommendation |
+| [Class implements ICloneable](https://codeql.github.com/codeql-query-help/csharp/cs-class-implements-icloneable/) | Maintainability | Recommendation |
+| [Constant condition](https://codeql.github.com/codeql-query-help/csharp/cs-constant-condition/) | Maintainability | Warning |
+| [Container contents are never accessed](https://codeql.github.com/codeql-query-help/csharp/cs-unused-collection/) | Maintainability | Error |
+| [Field masks field in super class](https://codeql.github.com/codeql-query-help/csharp/cs-field-masks-base-field/) | Maintainability | Warning |
+| [Futile conditional](https://codeql.github.com/codeql-query-help/csharp/cs-useless-if-statement/) | Maintainability | Warning |
+| [Local scope variable shadows member](https://codeql.github.com/codeql-query-help/csharp/cs-local-shadows-member/) | Maintainability | Recommendation |
+| [Missed 'readonly' opportunity](https://codeql.github.com/codeql-query-help/csharp/cs-missed-readonly-modifier/) | Maintainability | Recommendation |
+| [Missed 'using' opportunity](https://codeql.github.com/codeql-query-help/csharp/cs-missed-using-statement/) | Maintainability | Recommendation |
+| [Missed opportunity to use All](https://codeql.github.com/codeql-query-help/csharp/cs-linq-missed-all/) | Maintainability | Recommendation |
+| [Missed opportunity to use Cast](https://codeql.github.com/codeql-query-help/csharp/cs-linq-missed-cast/) | Maintainability | Recommendation |
+| [Missed opportunity to use OfType](https://codeql.github.com/codeql-query-help/csharp/cs-linq-missed-oftype/) | Maintainability | Recommendation |
+| [Missed opportunity to use Select](https://codeql.github.com/codeql-query-help/csharp/cs-linq-missed-select/) | Maintainability | Recommendation |
+| [Missed opportunity to use Where](https://codeql.github.com/codeql-query-help/csharp/cs-linq-missed-where/) | Maintainability | Recommendation |
+| [Missed ternary opportunity](https://codeql.github.com/codeql-query-help/csharp/cs-missed-ternary-operator/) | Maintainability | Recommendation |
+| [Nested 'if' statements can be combined](https://codeql.github.com/codeql-query-help/csharp/cs-nested-if-statements/) | Maintainability | Recommendation |
+| [Redundant Select](https://codeql.github.com/codeql-query-help/csharp/cs-linq-useless-select/) | Maintainability | Warning |
+| [Redundant ToString() call](https://codeql.github.com/codeql-query-help/csharp/cs-useless-tostring-call/) | Maintainability | Recommendation |
+| [Static field written by instance method](https://codeql.github.com/codeql-query-help/csharp/cs-static-field-written-by-instance/) | Maintainability | Recommendation |
+| [Unnecessarily complex Boolean expression](https://codeql.github.com/codeql-query-help/csharp/cs-simplifiable-boolean-expression/) | Maintainability | Recommendation |
+| [Unused label](https://codeql.github.com/codeql-query-help/csharp/cs-unused-label/) | Maintainability | Warning |
+| [Useless assignment to local variable](https://codeql.github.com/codeql-query-help/csharp/cs-useless-assignment-to-local/) | Maintainability | Warning |
+| [Useless call to GetHashCode()](https://codeql.github.com/codeql-query-help/csharp/cs-useless-gethashcode-call/) | Maintainability | Recommendation |
+| [A lock is held during a wait](https://codeql.github.com/codeql-query-help/csharp/cs-locked-wait/) | Reliability | Warning |
+| [Call to 'System.IO.Path.Combine' may silently drop its earlier arguments](https://codeql.github.com/codeql-query-help/csharp/cs-path-combine/) | Reliability | Recommendation |
+| [Call to GC.Collect()](https://codeql.github.com/codeql-query-help/csharp/cs-call-to-gc/) | Reliability | Warning |
+| [Call to ReferenceEquals(...) on value type expressions](https://codeql.github.com/codeql-query-help/csharp/cs-reference-equality-on-valuetypes/) | Reliability | Error |
+| [Calls to unmanaged code](https://codeql.github.com/codeql-query-help/csharp/cs-call-to-unmanaged-code/) | Reliability | Recommendation |
+| [Cast of 'this' to a type parameter](https://codeql.github.com/codeql-query-help/csharp/cs-cast-of-this-to-type-parameter/) | Reliability | Recommendation |
+| [Character passed to StringBuilder constructor](https://codeql.github.com/codeql-query-help/csharp/cs-stringbuilder-initialized-with-character/) | Reliability | Error |
+| [Comparison is constant](https://codeql.github.com/codeql-query-help/csharp/cs-constant-comparison/) | Reliability | Warning |
+| [Comparison of identical values](https://codeql.github.com/codeql-query-help/csharp/cs-comparison-of-identical-expressions/) | Reliability | Warning |
+| [Container contents are never initialized](https://codeql.github.com/codeql-query-help/csharp/cs-empty-collection/) | Reliability | Error |
+| [Container size compared to zero](https://codeql.github.com/codeql-query-help/csharp/cs-test-for-negative-container-size/) | Reliability | Warning |
+| [Dereferenced variable is always null](https://codeql.github.com/codeql-query-help/csharp/cs-dereferenced-value-is-always-null/) | Reliability | Error |
+| [Dereferenced variable may be null](https://codeql.github.com/codeql-query-help/csharp/cs-dereferenced-value-may-be-null/) | Reliability | Warning |
+| [Dubious downcast of 'this'](https://codeql.github.com/codeql-query-help/csharp/cs-downcast-of-this/) | Reliability | Warning |
+| [Dubious type test of 'this'](https://codeql.github.com/codeql-query-help/csharp/cs-type-test-of-this/) | Reliability | Warning |
+| [Empty branch of conditional, or empty loop body](https://codeql.github.com/codeql-query-help/csharp/cs-empty-block/) | Reliability | Warning |
+| [Empty lock statement](https://codeql.github.com/codeql-query-help/csharp/cs-empty-lock-statement/) | Reliability | Warning |
+| [Equality check on floating point values](https://codeql.github.com/codeql-query-help/csharp/cs-equality-on-floats/) | Reliability | Warning |
+| [Equals on collections](https://codeql.github.com/codeql-query-help/csharp/cs-equals-on-arrays/) | Reliability | Recommendation |
+| [Equals on incomparable types](https://codeql.github.com/codeql-query-help/csharp/cs-equals-on-unrelated-types/) | Reliability | Error |
+| [Exposing internal representation](https://codeql.github.com/codeql-query-help/csharp/cs-expose-implementation/) | Reliability | Recommendation |
+| [Futile synchronization on field](https://codeql.github.com/codeql-query-help/csharp/cs-unsafe-sync-on-field/) | Reliability | Error |
+| [Generic catch clause](https://codeql.github.com/codeql-query-help/csharp/cs-catch-of-all-exceptions/) | Reliability | Recommendation |
+| [Hashed value without GetHashCode definition](https://codeql.github.com/codeql-query-help/csharp/cs-gethashcode-is-not-defined/) | Reliability | Warning |
+| [Impossible array cast](https://codeql.github.com/codeql-query-help/csharp/cs-impossible-array-cast/) | Reliability | Error |
+| [Inconsistent lock sequence](https://codeql.github.com/codeql-query-help/csharp/cs-inconsistent-lock-sequence/) | Reliability | Error |
+| [Inefficient use of ContainsKey](https://codeql.github.com/codeql-query-help/csharp/cs-inefficient-containskey/) | Reliability | Recommendation |
+| [Invalid string formatting](https://codeql.github.com/codeql-query-help/csharp/cs-invalid-string-formatting/) | Reliability | Error |
+| [Locking the 'this' object in a lock statement](https://codeql.github.com/codeql-query-help/csharp/cs-lock-this/) | Reliability | Warning |
+| [Missing Dispose call on local IDisposable](https://codeql.github.com/codeql-query-help/csharp/cs-local-not-disposed/) | Reliability | Warning |
+| [Nested loops with same variable](https://codeql.github.com/codeql-query-help/csharp/cs-nested-loops-with-same-variable/) | Reliability | Warning |
+| [Null argument to Equals(object)](https://codeql.github.com/codeql-query-help/csharp/cs-null-argument-to-equals/) | Reliability | Warning |
+| [Off-by-one comparison against container length](https://codeql.github.com/codeql-query-help/csharp/cs-index-out-of-bounds/) | Reliability | Error |
+| [Poor error handling: catch of NullReferenceException](https://codeql.github.com/codeql-query-help/csharp/cs-catch-nullreferenceexception/) | Reliability | Warning |
+| [Poor error handling: empty catch block](https://codeql.github.com/codeql-query-help/csharp/cs-empty-catch-block/) | Reliability | Recommendation |
+| [Possible loss of precision](https://codeql.github.com/codeql-query-help/csharp/cs-loss-of-precision/) | Reliability | Error |
+| [Potentially dangerous use of non-short-circuit logic](https://codeql.github.com/codeql-query-help/csharp/cs-non-short-circuit/) | Reliability | Error |
+| [Property value is not used when setting a property](https://codeql.github.com/codeql-query-help/csharp/cs-unused-property-value/) | Reliability | Warning |
+| [Recursive call to Equals(object)](https://codeql.github.com/codeql-query-help/csharp/cs-recursive-equals-call/) | Reliability | Error |
+| [Rethrowing exception variable](https://codeql.github.com/codeql-query-help/csharp/cs-rethrown-exception-variable/) | Reliability | Warning |
+| [Self-assignment](https://codeql.github.com/codeql-query-help/csharp/cs-self-assignment/) | Reliability | Error |
+| [String concatenation in loop](https://codeql.github.com/codeql-query-help/csharp/cs-string-concatenation-in-loop/) | Reliability | Recommendation |
+| [StringBuilder creation in loop](https://codeql.github.com/codeql-query-help/csharp/cs-stringbuilder-creation-in-loop/) | Reliability | Recommendation |
+| [Unchecked cast in Equals method](https://codeql.github.com/codeql-query-help/csharp/cs-unchecked-cast-in-equals/) | Reliability | Warning |
+| [Unmanaged code](https://codeql.github.com/codeql-query-help/csharp/cs-unmanaged-code/) | Reliability | Recommendation |
+| [Use of default ToString()](https://codeql.github.com/codeql-query-help/csharp/cs-call-to-object-tostring/) | Reliability | Warning |
+
+{% endrowheaders %}
diff --git a/data/reusables/code-quality/codeql-query-tables/go.md b/data/reusables/code-quality/codeql-query-tables/go.md
new file mode 100644
index 000000000000..6d6f07987b9a
--- /dev/null
+++ b/data/reusables/code-quality/codeql-query-tables/go.md
@@ -0,0 +1,28 @@
+{% rowheaders %}
+
+| Query name | Category | Severity |
+| --- | --- | --- |
+| [Useless assignment to field](https://codeql.github.com/codeql-query-help/go/go-useless-assignment-to-field/) | Maintainability | Warning |
+| [Useless assignment to local variable](https://codeql.github.com/codeql-query-help/go/go-useless-assignment-to-local/) | Maintainability | Warning |
+| [Bitwise exclusive-or used like exponentiation](https://codeql.github.com/codeql-query-help/go/go-mistyped-exponentiation/) | Reliability | Warning |
+| [Comparison of identical values](https://codeql.github.com/codeql-query-help/go/go-comparison-of-identical-expressions/) | Reliability | Warning |
+| [Constant length comparison](https://codeql.github.com/codeql-query-help/go/go-constant-length-comparison/) | Reliability | Warning |
+| [Duplicate 'if' branches](https://codeql.github.com/codeql-query-help/go/go-duplicate-branches/) | Reliability | Warning |
+| [Duplicate 'if' condition](https://codeql.github.com/codeql-query-help/go/go-duplicate-condition/) | Reliability | Error |
+| [Duplicate switch case](https://codeql.github.com/codeql-query-help/go/go-duplicate-switch-case/) | Reliability | Error |
+| [Expression has no effect](https://codeql.github.com/codeql-query-help/go/go-useless-expression/) | Reliability | Warning |
+| [Identical operands](https://codeql.github.com/codeql-query-help/go/go-redundant-operation/) | Reliability | Warning |
+| [Impossible interface nil check](https://codeql.github.com/codeql-query-help/go/go-impossible-interface-nil-check/) | Reliability | Warning |
+| [Inconsistent direction of for loop](https://codeql.github.com/codeql-query-help/go/go-inconsistent-loop-direction/) | Reliability | Error |
+| [Missing error check](https://codeql.github.com/codeql-query-help/go/go-missing-error-check/) | Reliability | Warning |
+| [Off-by-one comparison against length](https://codeql.github.com/codeql-query-help/go/go-index-out-of-bounds/) | Reliability | Error |
+| [Redundant call to recover](https://codeql.github.com/codeql-query-help/go/go-redundant-recover/) | Reliability | Warning |
+| [Redundant check for negative value](https://codeql.github.com/codeql-query-help/go/go-negative-length-check/) | Reliability | Warning |
+| [Self assignment](https://codeql.github.com/codeql-query-help/go/go-redundant-assignment/) | Reliability | Warning |
+| [Shift out of range](https://codeql.github.com/codeql-query-help/go/go-shift-out-of-range/) | Reliability | Warning |
+| [Unreachable statement](https://codeql.github.com/codeql-query-help/go/go-unreachable-statement/) | Reliability | Warning |
+| [Whitespace contradicts operator precedence](https://codeql.github.com/codeql-query-help/go/go-whitespace-contradicts-precedence/) | Reliability | Warning |
+| [Wrapped error is always nil](https://codeql.github.com/codeql-query-help/go/go-unexpected-nil-value/) | Reliability | Warning |
+| [Writable file handle closed without error handling](https://codeql.github.com/codeql-query-help/go/go-unhandled-writable-file-close/) | Reliability | Warning |
+
+{% endrowheaders %}
diff --git a/data/reusables/code-quality/codeql-query-tables/java.md b/data/reusables/code-quality/codeql-query-tables/java.md
new file mode 100644
index 000000000000..c7ae68164570
--- /dev/null
+++ b/data/reusables/code-quality/codeql-query-tables/java.md
@@ -0,0 +1,95 @@
+{% rowheaders %}
+
+| Query name | Category | Severity |
+| --- | --- | --- |
+| [Access to unsupported JDK-internal API](https://codeql.github.com/codeql-query-help/java/java-jdk-internal-api-access/) | Maintainability | Recommendation |
+| [Boxed variable is never null](https://codeql.github.com/codeql-query-help/java/java-non-null-boxed-variable/) | Maintainability | Warning |
+| [Cast from abstract to concrete collection](https://codeql.github.com/codeql-query-help/java/java-abstract-to-concrete-cast/) | Maintainability | Warning |
+| [Class has same name as super class](https://codeql.github.com/codeql-query-help/java/java-class-name-matches-super-class/) | Maintainability | Recommendation |
+| [Confusing method names because of capitalization](https://codeql.github.com/codeql-query-help/java/java-confusing-method-name/) | Maintainability | Recommendation |
+| [Confusing overloading of methods](https://codeql.github.com/codeql-query-help/java/java-confusing-method-signature/) | Maintainability | Recommendation |
+| [Constant interface anti-pattern](https://codeql.github.com/codeql-query-help/java/java-constants-only-interface/) | Maintainability | Recommendation |
+| [Container contents are never accessed](https://codeql.github.com/codeql-query-help/java/java-unused-container/) | Maintainability | Error |
+| [Inefficient empty string test](https://codeql.github.com/codeql-query-help/java/java-inefficient-empty-string-test/) | Maintainability | Recommendation |
+| [Inefficient String constructor](https://codeql.github.com/codeql-query-help/java/java-inefficient-string-constructor/) | Maintainability | Recommendation |
+| [Inner class could be static](https://codeql.github.com/codeql-query-help/java/java-non-static-nested-class/) | Maintainability | Recommendation |
+| [Interface cannot be implemented](https://codeql.github.com/codeql-query-help/java/java-unimplementable-interface/) | Maintainability | Warning |
+| [Javadoc has impossible 'throws' tag](https://codeql.github.com/codeql-query-help/java/java-inconsistent-javadoc-throws/) | Maintainability | Recommendation |
+| [Misleading indentation](https://codeql.github.com/codeql-query-help/java/java-misleading-indentation/) | Maintainability | Warning |
+| [Missing Override annotation](https://codeql.github.com/codeql-query-help/java/java-missing-override-annotation/) | Maintainability | Recommendation |
+| [Missing space in string literal](https://codeql.github.com/codeql-query-help/java/java-missing-space-in-concatenation/) | Maintainability | Recommendation |
+| [Mocking all public methods of a class may indicate the unit test is testing too much](https://codeql.github.com/codeql-query-help/java/java-excessive-public-method-mocking/) | Maintainability | Recommendation |
+| [Non-case label in switch statement](https://codeql.github.com/codeql-query-help/java/java-label-in-switch/) | Maintainability | Recommendation |
+| [Non-explicit control and whitespace characters](https://codeql.github.com/codeql-query-help/java/java-non-explicit-control-and-whitespace-chars-in-literals/) | Maintainability | Warning |
+| [Possible confusion of local and field](https://codeql.github.com/codeql-query-help/java/java-local-shadows-field/) | Maintainability | Recommendation |
+| [Spurious Javadoc @param tags](https://codeql.github.com/codeql-query-help/java/java-unknown-javadoc-parameter/) | Maintainability | Recommendation |
+| [Subtle call to inherited method](https://codeql.github.com/codeql-query-help/java/java-subtle-inherited-call/) | Maintainability | Warning |
+| [Underscore used as identifier](https://codeql.github.com/codeql-query-help/java/java-underscore-identifier/) | Maintainability | Recommendation |
+| [Unread local variable](https://codeql.github.com/codeql-query-help/java/java-local-variable-is-never-read/) | Maintainability | Recommendation |
+| [Unused classes and interfaces](https://codeql.github.com/codeql-query-help/java/java-unused-reference-type/) | Maintainability | Recommendation |
+| [Unused format argument](https://codeql.github.com/codeql-query-help/java/java-unused-format-argument/) | Maintainability | Warning |
+| [Unused label](https://codeql.github.com/codeql-query-help/java/java-unused-label/) | Maintainability | Recommendation |
+| [Use of VisibleForTesting in production code](https://codeql.github.com/codeql-query-help/java/java-visible-for-testing-abuse/) | Maintainability | Warning |
+| [Useless null check](https://codeql.github.com/codeql-query-help/java/java-useless-null-check/) | Maintainability | Warning |
+| [Useless parameter](https://codeql.github.com/codeql-query-help/java/java-unused-parameter/) | Maintainability | Recommendation |
+| [Useless toString on String](https://codeql.github.com/codeql-query-help/java/java-useless-tostring-call/) | Maintainability | Recommendation |
+| [Useless type test](https://codeql.github.com/codeql-query-help/java/java-useless-type-test/) | Maintainability | Warning |
+| [Array index out of bounds](https://codeql.github.com/codeql-query-help/java/java-index-out-of-bounds/) | Reliability | Error |
+| [Character passed to StringBuffer or StringBuilder constructor](https://codeql.github.com/codeql-query-help/java/java-string-buffer-char-init/) | Reliability | Error |
+| [Comparison of identical values](https://codeql.github.com/codeql-query-help/java/java-comparison-of-identical-expressions/) | Reliability | Error |
+| [Constant loop condition](https://codeql.github.com/codeql-query-help/java/java-constant-loop-condition/) | Reliability | Warning |
+| [Container contents are never initialized](https://codeql.github.com/codeql-query-help/java/java-empty-container/) | Reliability | Error |
+| [Container size compared to zero](https://codeql.github.com/codeql-query-help/java/java-test-for-negative-container-size/) | Reliability | Warning |
+| [Continue statement that does not continue](https://codeql.github.com/codeql-query-help/java/java-continue-in-false-loop/) | Reliability | Warning |
+| [Contradictory type checks](https://codeql.github.com/codeql-query-help/java/java-contradictory-type-checks/) | Reliability | Error |
+| [Dereferenced expression may be null](https://codeql.github.com/codeql-query-help/java/java-dereferenced-expr-may-be-null/) | Reliability | Warning |
+| [Dereferenced variable is always null](https://codeql.github.com/codeql-query-help/java/java-dereferenced-value-is-always-null/) | Reliability | Error |
+| [Dereferenced variable may be null](https://codeql.github.com/codeql-query-help/java/java-dereferenced-value-may-be-null/) | Reliability | Warning |
+| [Direct call to a run() method](https://codeql.github.com/codeql-query-help/java/java-call-to-thread-run/) | Reliability | Recommendation |
+| [Do not call `finalize()`](https://codeql.github.com/codeql-query-help/java/java-do-not-call-finalize/) | Reliability | Error |
+| [Double-checked locking is not thread-safe](https://codeql.github.com/codeql-query-help/java/java-unsafe-double-checked-locking/) | Reliability | Error |
+| [Equals method does not inspect argument type](https://codeql.github.com/codeql-query-help/java/java-unchecked-cast-in-equals/) | Reliability | Error |
+| [Equals on incomparable types](https://codeql.github.com/codeql-query-help/java/java-equals-on-unrelated-types/) | Reliability | Error |
+| [Equals or hashCode on arrays](https://codeql.github.com/codeql-query-help/java/java-equals-on-arrays/) | Reliability | Error |
+| [Escaping](https://codeql.github.com/codeql-query-help/java/java-escaping/) | Reliability | Warning |
+| [Exposing internal representation](https://codeql.github.com/codeql-query-help/java/java-internal-representation-exposure/) | Reliability | Recommendation |
+| [Expression always evaluates to the same value](https://codeql.github.com/codeql-query-help/java/java-evaluation-to-constant/) | Reliability | Warning |
+| [Hashed value without hashCode definition](https://codeql.github.com/codeql-query-help/java/java-hashing-without-hashcode/) | Reliability | Error |
+| [Ignored error status of call](https://codeql.github.com/codeql-query-help/java/java-ignored-error-status-of-call/) | Reliability | Recommendation |
+| [Ignored serialization member of record class](https://codeql.github.com/codeql-query-help/java/java-ignored-serialization-member-of-record-class/) | Reliability | Warning |
+| [Implicit conversion from array to string](https://codeql.github.com/codeql-query-help/java/java-print-array/) | Reliability | Recommendation |
+| [Inconsistent equals and hashCode](https://codeql.github.com/codeql-query-help/java/java-inconsistent-equals-and-hashcode/) | Reliability | Error |
+| [Inconsistent synchronization of getter and setter](https://codeql.github.com/codeql-query-help/java/java-unsynchronized-getter/) | Reliability | Error |
+| [Inefficient output stream](https://codeql.github.com/codeql-query-help/java/java-inefficient-output-stream/) | Reliability | Warning |
+| [Inefficient primitive constructor](https://codeql.github.com/codeql-query-help/java/java-inefficient-boxed-constructor/) | Reliability | Recommendation |
+| [Inefficient use of key set iterator](https://codeql.github.com/codeql-query-help/java/java-inefficient-key-set-iterator/) | Reliability | Recommendation |
+| [Iterable wrapping an iterator](https://codeql.github.com/codeql-query-help/java/java-iterable-wraps-iterator/) | Reliability | Warning |
+| [Iterator implementing Iterable](https://codeql.github.com/codeql-query-help/java/java-iterator-implements-iterable/) | Reliability | Warning |
+| [Left shift by more than the type width](https://codeql.github.com/codeql-query-help/java/java-lshift-larger-than-type-width/) | Reliability | Warning |
+| [Missing `@Nested` annotation on JUnit 5 inner test class](https://codeql.github.com/codeql-query-help/java/java-junit5-missing-nested-annotation/) | Reliability | Warning |
+| [Missing catch of NumberFormatException](https://codeql.github.com/codeql-query-help/java/java-uncaught-number-format-exception/) | Reliability | Recommendation |
+| [Missing format argument](https://codeql.github.com/codeql-query-help/java/java-missing-format-argument/) | Reliability | Error |
+| [Non-final method invocation in constructor](https://codeql.github.com/codeql-query-help/java/java-non-final-call-in-constructor/) | Reliability | Error |
+| [Non-synchronized override of synchronized method](https://codeql.github.com/codeql-query-help/java/java-non-sync-override/) | Reliability | Warning |
+| [Not thread-safe](https://codeql.github.com/codeql-query-help/java/java-not-threadsafe/) | Reliability | Warning |
+| [Potential database resource leak](https://codeql.github.com/codeql-query-help/java/java-database-resource-leak/) | Reliability | Warning |
+| [Potential input resource leak](https://codeql.github.com/codeql-query-help/java/java-input-resource-leak/) | Reliability | Warning |
+| [Potential output resource leak](https://codeql.github.com/codeql-query-help/java/java-output-resource-leak/) | Reliability | Warning |
+| [Race condition in double-checked locking object initialization](https://codeql.github.com/codeql-query-help/java/java-unsafe-double-checked-locking-init-order/) | Reliability | Warning |
+| [Reference equality test of boxed types](https://codeql.github.com/codeql-query-help/java/java-reference-equality-of-boxed-types/) | Reliability | Error |
+| [Result of multiplication cast to wider type](https://codeql.github.com/codeql-query-help/java/java-integer-multiplication-cast-to-long/) | Reliability | Warning |
+| [Safe publication](https://codeql.github.com/codeql-query-help/java/java-safe-publication/) | Reliability | Warning |
+| [Self assignment](https://codeql.github.com/codeql-query-help/java/java-redundant-assignment/) | Reliability | Error |
+| [Suspicious date format](https://codeql.github.com/codeql-query-help/java/java-suspicious-date-format/) | Reliability | Warning |
+| [Synchronization on boxed types or strings](https://codeql.github.com/codeql-query-help/java/java-sync-on-boxed-types/) | Reliability | Error |
+| [Type mismatch on container access](https://codeql.github.com/codeql-query-help/java/java-type-mismatch-access/) | Reliability | Error |
+| [Type mismatch on container modification](https://codeql.github.com/codeql-query-help/java/java-type-mismatch-modification/) | Reliability | Error |
+| [Unreachable catch clause](https://codeql.github.com/codeql-query-help/java/java-unreachable-catch-clause/) | Reliability | Warning |
+| [Use of `String#replaceAll` with a first argument which is not a regular expression](https://codeql.github.com/codeql-query-help/java/java-string-replace-all-with-non-regex/) | Reliability | Recommendation |
+| [Use of default toString()](https://codeql.github.com/codeql-query-help/java/java-call-to-object-tostring/) | Reliability | Recommendation |
+| [Useless comparison test](https://codeql.github.com/codeql-query-help/java/java-constant-comparison/) | Reliability | Warning |
+| [Whitespace contradicts operator precedence](https://codeql.github.com/codeql-query-help/java/java-whitespace-contradicts-precedence/) | Reliability | Warning |
+| [Wrong NaN comparison](https://codeql.github.com/codeql-query-help/java/java-comparison-with-nan/) | Reliability | Error |
+| [Zero threads set for `java.util.concurrent.ScheduledThreadPoolExecutor`](https://codeql.github.com/codeql-query-help/java/java-java-util-concurrent-scheduledthreadpoolexecutor/) | Reliability | Recommendation |
+
+{% endrowheaders %}
diff --git a/data/reusables/code-quality/codeql-query-tables/javascript.md b/data/reusables/code-quality/codeql-query-tables/javascript.md
new file mode 100644
index 000000000000..05e09d5629ff
--- /dev/null
+++ b/data/reusables/code-quality/codeql-query-tables/javascript.md
@@ -0,0 +1,104 @@
+{% rowheaders %}
+
+| Query name | Category | Severity |
+| --- | --- | --- |
+| [Call to eval-like DOM function](https://codeql.github.com/codeql-query-help/javascript/js-eval-like-call/) | Maintainability | Recommendation |
+| [Duplicate dependency](https://codeql.github.com/codeql-query-help/javascript/js-angular-duplicate-dependency/) | Maintainability | Warning |
+| [Duplicate HTML element attributes](https://codeql.github.com/codeql-query-help/javascript/js-duplicate-html-attribute/) | Maintainability | Warning |
+| [Duplicate property](https://codeql.github.com/codeql-query-help/javascript/js-duplicate-property/) | Maintainability | Warning |
+| [Duplicate variable declaration](https://codeql.github.com/codeql-query-help/javascript/js-duplicate-variable-declaration/) | Maintainability | Recommendation |
+| [Expression has no effect](https://codeql.github.com/codeql-query-help/javascript/js-useless-expression/) | Maintainability | Warning |
+| [Misleading indentation after control statement](https://codeql.github.com/codeql-query-help/javascript/js-misleading-indentation-after-control-statement/) | Maintainability | Warning |
+| [Misleading indentation of dangling 'else'](https://codeql.github.com/codeql-query-help/javascript/js-misleading-indentation-of-dangling-else/) | Maintainability | Warning |
+| [Missing space in string concatenation](https://codeql.github.com/codeql-query-help/javascript/js-missing-space-in-concatenation/) | Maintainability | Warning |
+| [Repeated dependency injection](https://codeql.github.com/codeql-query-help/javascript/js-angular-repeated-dependency-injection/) | Maintainability | Warning |
+| [Semicolon insertion](https://codeql.github.com/codeql-query-help/javascript/js-automatic-semicolon-insertion/) | Maintainability | Recommendation |
+| [Unclear precedence of nested operators](https://codeql.github.com/codeql-query-help/javascript/js-unclear-operator-precedence/) | Maintainability | Recommendation |
+| [Unneeded defensive code](https://codeql.github.com/codeql-query-help/javascript/js-unneeded-defensive-code/) | Maintainability | Recommendation |
+| [Unused variable, import, function or class](https://codeql.github.com/codeql-query-help/javascript/js-unused-local-variable/) | Maintainability | Recommendation |
+| [Use of for-in comprehension blocks](https://codeql.github.com/codeql-query-help/javascript/js-for-in-comprehension/) | Maintainability | Error |
+| [Use of platform-specific language features](https://codeql.github.com/codeql-query-help/javascript/js-non-standard-language-feature/) | Maintainability | Warning |
+| [Useless assignment to local variable](https://codeql.github.com/codeql-query-help/javascript/js-useless-assignment-to-local/) | Maintainability | Warning |
+| [Useless assignment to property](https://codeql.github.com/codeql-query-help/javascript/js-useless-assignment-to-property/) | Maintainability | Warning |
+| [Useless return in setter](https://codeql.github.com/codeql-query-help/javascript/js-setter-return/) | Maintainability | Warning |
+| [Variable not declared before use](https://codeql.github.com/codeql-query-help/javascript/js-use-before-declaration/) | Maintainability | Warning |
+| [With statement](https://codeql.github.com/codeql-query-help/javascript/js-with-statement/) | Maintainability | Warning |
+| [Access to let-bound variable in temporal dead zone](https://codeql.github.com/codeql-query-help/javascript/js-variable-use-in-temporal-dead-zone/) | Reliability | Error |
+| [Arguments redefined](https://codeql.github.com/codeql-query-help/javascript/js-arguments-redefinition/) | Reliability | Recommendation |
+| [Arrow method on Vue instance](https://codeql.github.com/codeql-query-help/javascript/js-vue-arrow-method-on-vue-instance/) | Reliability | Warning |
+| [Assignment to constant](https://codeql.github.com/codeql-query-help/javascript/js-assignment-to-constant/) | Reliability | Error |
+| [Assignment to exports variable](https://codeql.github.com/codeql-query-help/javascript/js-node-assignment-to-exports-variable/) | Reliability | Warning |
+| [Assignment to property of primitive value](https://codeql.github.com/codeql-query-help/javascript/js-property-assignment-on-primitive/) | Reliability | Error |
+| [Back reference into negative lookahead assertion](https://codeql.github.com/codeql-query-help/javascript/js-regex-back-reference-to-negative-lookahead/) | Reliability | Error |
+| [Back reference precedes capture group](https://codeql.github.com/codeql-query-help/javascript/js-regex-back-reference-before-group/) | Reliability | Error |
+| [Comparison between inconvertible types](https://codeql.github.com/codeql-query-help/javascript/js-comparison-between-incompatible-types/) | Reliability | Warning |
+| [Comparison with NaN](https://codeql.github.com/codeql-query-help/javascript/js-comparison-with-nan/) | Reliability | Error |
+| [Conditional comments](https://codeql.github.com/codeql-query-help/javascript/js-conditional-comment/) | Reliability | Warning |
+| [Conflicting function declarations](https://codeql.github.com/codeql-query-help/javascript/js-function-declaration-conflict/) | Reliability | Error |
+| [Conflicting variable initialization](https://codeql.github.com/codeql-query-help/javascript/js-variable-initialization-conflict/) | Reliability | Error |
+| [Default parameter references nested function](https://codeql.github.com/codeql-query-help/javascript/js-nested-function-reference-in-default-parameter/) | Reliability | Error |
+| [Deleting non-property](https://codeql.github.com/codeql-query-help/javascript/js-deletion-of-non-property/) | Reliability | Warning |
+| [Dependency mismatch](https://codeql.github.com/codeql-query-help/javascript/js-angular-dependency-injection-mismatch/) | Reliability | Warning |
+| [Direct state mutation](https://codeql.github.com/codeql-query-help/javascript/js-react-direct-state-mutation/) | Reliability | Warning |
+| [Duplicate 'if' condition](https://codeql.github.com/codeql-query-help/javascript/js-duplicate-condition/) | Reliability | Warning |
+| [Duplicate character in character class](https://codeql.github.com/codeql-query-help/javascript/js-regex-duplicate-in-character-class/) | Reliability | Warning |
+| [Duplicate parameter names](https://codeql.github.com/codeql-query-help/javascript/js-duplicate-parameter-name/) | Reliability | Error |
+| [Duplicate switch case](https://codeql.github.com/codeql-query-help/javascript/js-duplicate-switch-case/) | Reliability | Warning |
+| [Empty character class](https://codeql.github.com/codeql-query-help/javascript/js-regex-empty-character-class/) | Reliability | Warning |
+| [Identical operands](https://codeql.github.com/codeql-query-help/javascript/js-redundant-operation/) | Reliability | Warning |
+| [Ignoring result from pure array method](https://codeql.github.com/codeql-query-help/javascript/js-ignore-array-result/) | Reliability | Warning |
+| [Illegal invocation](https://codeql.github.com/codeql-query-help/javascript/js-illegal-invocation/) | Reliability | Error |
+| [Implicit operand conversion](https://codeql.github.com/codeql-query-help/javascript/js-implicit-operand-conversion/) | Reliability | Warning |
+| [Incompatible dependency injection](https://codeql.github.com/codeql-query-help/javascript/js-angular-incompatible-service/) | Reliability | Error |
+| [Inconsistent direction of for loop](https://codeql.github.com/codeql-query-help/javascript/js-inconsistent-loop-direction/) | Reliability | Error |
+| [Inconsistent use of 'new'](https://codeql.github.com/codeql-query-help/javascript/js-inconsistent-use-of-new/) | Reliability | Warning |
+| [Ineffective parameter type](https://codeql.github.com/codeql-query-help/javascript/js-ineffective-parameter-type/) | Reliability | Warning |
+| [Invalid prototype value](https://codeql.github.com/codeql-query-help/javascript/js-invalid-prototype-value/) | Reliability | Error |
+| [Invocation of non-function](https://codeql.github.com/codeql-query-help/javascript/js-call-to-non-callable/) | Reliability | Error |
+| [Loop iteration skipped due to shifting](https://codeql.github.com/codeql-query-help/javascript/js-loop-iteration-skipped-due-to-shifting/) | Reliability | Warning |
+| [Malformed id attribute](https://codeql.github.com/codeql-query-help/javascript/js-malformed-html-id/) | Reliability | Warning |
+| [Missing '.length' in comparison](https://codeql.github.com/codeql-query-help/javascript/js-missing-dot-length-in-comparison/) | Reliability | Warning |
+| [Missing 'this' qualifier](https://codeql.github.com/codeql-query-help/javascript/js-missing-this-qualifier/) | Reliability | Error |
+| [Missing await](https://codeql.github.com/codeql-query-help/javascript/js-missing-await/) | Reliability | Warning |
+| [Missing explicit dependency injection](https://codeql.github.com/codeql-query-help/javascript/js-angular-missing-explicit-injection/) | Reliability | Warning |
+| [Missing exports qualifier](https://codeql.github.com/codeql-query-help/javascript/js-node-missing-exports-qualifier/) | Reliability | Error |
+| [Missing variable declaration](https://codeql.github.com/codeql-query-help/javascript/js-missing-variable-declaration/) | Reliability | Warning |
+| [Misspelled variable name](https://codeql.github.com/codeql-query-help/javascript/js-misspelled-variable-name/) | Reliability | Warning |
+| [Non-case label in switch statement](https://codeql.github.com/codeql-query-help/javascript/js-label-in-switch/) | Reliability | Warning |
+| [Non-linear pattern](https://codeql.github.com/codeql-query-help/javascript/js-non-linear-pattern/) | Reliability | Error |
+| [Off-by-one comparison against length](https://codeql.github.com/codeql-query-help/javascript/js-index-out-of-bounds/) | Reliability | Warning |
+| [Overwritten property](https://codeql.github.com/codeql-query-help/javascript/js-overwritten-property/) | Reliability | Error |
+| [Potentially inconsistent state update](https://codeql.github.com/codeql-query-help/javascript/js-react-inconsistent-state-update/) | Reliability | Warning |
+| [Property access on null or undefined](https://codeql.github.com/codeql-query-help/javascript/js-property-access-on-non-object/) | Reliability | Error |
+| [Regular expression always matches](https://codeql.github.com/codeql-query-help/javascript/js-regex-always-matches/) | Reliability | Warning |
+| [Return statement assigns local variable](https://codeql.github.com/codeql-query-help/javascript/js-useless-assignment-in-return/) | Reliability | Warning |
+| [Self assignment](https://codeql.github.com/codeql-query-help/javascript/js-redundant-assignment/) | Reliability | Warning |
+| [Shift out of range](https://codeql.github.com/codeql-query-help/javascript/js-shift-out-of-range/) | Reliability | Error |
+| [String instead of regular expression](https://codeql.github.com/codeql-query-help/javascript/js-string-instead-of-regex/) | Reliability | Warning |
+| [Superfluous trailing arguments](https://codeql.github.com/codeql-query-help/javascript/js-superfluous-trailing-arguments/) | Reliability | Warning |
+| [Suspicious method name declaration](https://codeql.github.com/codeql-query-help/javascript/js-suspicious-method-name-declaration/) | Reliability | Warning |
+| [Template syntax in string literal](https://codeql.github.com/codeql-query-help/javascript/js-template-syntax-in-string-literal/) | Reliability | Warning |
+| [Unbound back reference](https://codeql.github.com/codeql-query-help/javascript/js-regex-unbound-back-reference/) | Reliability | Warning |
+| [Unbound event handler receiver](https://codeql.github.com/codeql-query-help/javascript/js-unbound-event-handler-receiver/) | Reliability | Error |
+| [Unhandled error in stream pipeline](https://codeql.github.com/codeql-query-help/javascript/js-unhandled-error-in-stream-pipeline/) | Reliability | Warning |
+| [Unknown directive](https://codeql.github.com/codeql-query-help/javascript/js-unknown-directive/) | Reliability | Warning |
+| [Unmatchable caret in regular expression](https://codeql.github.com/codeql-query-help/javascript/js-regex-unmatchable-caret/) | Reliability | Error |
+| [Unmatchable dollar in regular expression](https://codeql.github.com/codeql-query-help/javascript/js-regex-unmatchable-dollar/) | Reliability | Error |
+| [Unreachable method overloads](https://codeql.github.com/codeql-query-help/javascript/js-unreachable-method-overloads/) | Reliability | Warning |
+| [Unreachable statement](https://codeql.github.com/codeql-query-help/javascript/js-unreachable-statement/) | Reliability | Warning |
+| [Unsupported state update in lifecycle method](https://codeql.github.com/codeql-query-help/javascript/js-react-unsupported-state-update-in-lifecycle-method/) | Reliability | Warning |
+| [Unused index variable](https://codeql.github.com/codeql-query-help/javascript/js-unused-index-variable/) | Reliability | Warning |
+| [Unused loop iteration variable](https://codeql.github.com/codeql-query-help/javascript/js-unused-loop-variable/) | Reliability | Error |
+| [Unused or undefined state property](https://codeql.github.com/codeql-query-help/javascript/js-react-unused-or-undefined-state-property/) | Reliability | Warning |
+| [Use of AngularJS markup in URL-valued attribute](https://codeql.github.com/codeql-query-help/javascript/js-angular-expression-in-url-attribute/) | Reliability | Warning |
+| [Use of call stack introspection in strict mode](https://codeql.github.com/codeql-query-help/javascript/js-strict-mode-call-stack-introspection/) | Reliability | Error |
+| [Use of incompletely initialized object](https://codeql.github.com/codeql-query-help/javascript/js-incomplete-object-initialization/) | Reliability | Error |
+| [Use of returnless function](https://codeql.github.com/codeql-query-help/javascript/js-use-of-returnless-function/) | Reliability | Warning |
+| [Useless comparison test](https://codeql.github.com/codeql-query-help/javascript/js-useless-comparison-test/) | Reliability | Warning |
+| [Useless conditional](https://codeql.github.com/codeql-query-help/javascript/js-trivial-conditional/) | Reliability | Warning |
+| [Useless type test](https://codeql.github.com/codeql-query-help/javascript/js-useless-type-test/) | Reliability | Error |
+| [Whitespace contradicts operator precedence](https://codeql.github.com/codeql-query-help/javascript/js-whitespace-contradicts-precedence/) | Reliability | Warning |
+| [Wrong use of 'this' for static method](https://codeql.github.com/codeql-query-help/javascript/js-mixed-static-instance-this-access/) | Reliability | Error |
+| [Yield in non-generator function](https://codeql.github.com/codeql-query-help/javascript/js-yield-outside-generator/) | Reliability | Error |
+
+{% endrowheaders %}
diff --git a/data/reusables/code-quality/codeql-query-tables/python.md b/data/reusables/code-quality/codeql-query-tables/python.md
new file mode 100644
index 000000000000..3360acd49b7c
--- /dev/null
+++ b/data/reusables/code-quality/codeql-query-tables/python.md
@@ -0,0 +1,107 @@
+{% rowheaders %}
+
+| Query name | Category | Severity |
+| --- | --- | --- |
+| ['import *' may pollute namespace](https://codeql.github.com/codeql-query-help/python/py-polluting-import/) | Maintainability | Recommendation |
+| [Backspace escape in regular expression](https://codeql.github.com/codeql-query-help/python/py-regex-backspace-escape/) | Maintainability | Recommendation |
+| [Commented-out code](https://codeql.github.com/codeql-query-help/python/py-commented-out-code/) | Maintainability | Recommendation |
+| [Comparison of constants](https://codeql.github.com/codeql-query-help/python/py-comparison-of-constants/) | Maintainability | Warning |
+| [Comparison of identical values](https://codeql.github.com/codeql-query-help/python/py-comparison-of-identical-expressions/) | Maintainability | Warning |
+| [Constant in conditional expression or statement](https://codeql.github.com/codeql-query-help/python/py-constant-conditional-expression/) | Maintainability | Warning |
+| [Duplicate key in dict literal](https://codeql.github.com/codeql-query-help/python/py-duplicate-key-dict-literal/) | Maintainability | Warning |
+| [Duplication in regular expression character class](https://codeql.github.com/codeql-query-help/python/py-regex-duplicate-in-character-class/) | Maintainability | Warning |
+| [First parameter of a class method is not named 'cls'](https://codeql.github.com/codeql-query-help/python/py-not-named-cls/) | Maintainability | Recommendation |
+| [First parameter of a method is not named 'self'](https://codeql.github.com/codeql-query-help/python/py-not-named-self/) | Maintainability | Recommendation |
+| [Implicit string concatenation in a list](https://codeql.github.com/codeql-query-help/python/py-implicit-string-concatenation-in-list/) | Maintainability | Warning |
+| [Imprecise assert](https://codeql.github.com/codeql-query-help/python/py-imprecise-assert/) | Maintainability | Recommendation |
+| [Module imports itself](https://codeql.github.com/codeql-query-help/python/py-import-own-module/) | Maintainability | Recommendation |
+| [Module is imported more than once](https://codeql.github.com/codeql-query-help/python/py-repeated-import/) | Maintainability | Recommendation |
+| [Module is imported with 'import' and 'import from'](https://codeql.github.com/codeql-query-help/python/py-import-and-import-from/) | Maintainability | Recommendation |
+| [Nested loops with same variable](https://codeql.github.com/codeql-query-help/python/py-nested-loops-with-same-variable/) | Maintainability | Recommendation |
+| [Overly complex `__del__` method](https://codeql.github.com/codeql-query-help/python/py-overly-complex-delete/) | Maintainability | Recommendation |
+| [Redundant comparison](https://codeql.github.com/codeql-query-help/python/py-redundant-comparison/) | Maintainability | Warning |
+| [Should use a 'with' statement](https://codeql.github.com/codeql-query-help/python/py-should-use-with/) | Maintainability | Recommendation |
+| [Statement has no effect](https://codeql.github.com/codeql-query-help/python/py-ineffectual-statement/) | Maintainability | Recommendation |
+| [Unnecessary 'else' clause in loop](https://codeql.github.com/codeql-query-help/python/py-redundant-else/) | Maintainability | Warning |
+| [Unnecessary lambda](https://codeql.github.com/codeql-query-help/python/py-unnecessary-lambda/) | Maintainability | Recommendation |
+| [Unnecessary pass](https://codeql.github.com/codeql-query-help/python/py-unnecessary-pass/) | Maintainability | Warning |
+| [Unreachable code](https://codeql.github.com/codeql-query-help/python/py-unreachable-statement/) | Maintainability | Warning |
+| [Unused argument in a formatting call](https://codeql.github.com/codeql-query-help/python/py-str-format-surplus-argument/) | Maintainability | Warning |
+| [Unused global variable](https://codeql.github.com/codeql-query-help/python/py-unused-global-variable/) | Maintainability | Recommendation |
+| [Unused import](https://codeql.github.com/codeql-query-help/python/py-unused-import/) | Maintainability | Recommendation |
+| [Unused local variable](https://codeql.github.com/codeql-query-help/python/py-unused-local-variable/) | Maintainability | Recommendation |
+| [Unused named argument in formatting call](https://codeql.github.com/codeql-query-help/python/py-str-format-surplus-named-argument/) | Maintainability | Warning |
+| [Use of 'global' at module level](https://codeql.github.com/codeql-query-help/python/py-redundant-global-declaration/) | Maintainability | Warning |
+| [Use of the return value of a procedure](https://codeql.github.com/codeql-query-help/python/py-procedure-return-value-used/) | Maintainability | Warning |
+| [Variable defined multiple times](https://codeql.github.com/codeql-query-help/python/py-multiple-definition/) | Maintainability | Warning |
+| [`__del__` is called explicitly](https://codeql.github.com/codeql-query-help/python/py-explicit-call-to-delete/) | Reliability | Warning |
+| [`__eq__` not overridden when adding attributes](https://codeql.github.com/codeql-query-help/python/py-missing-equals/) | Reliability | Warning |
+| [`__init__` method calls overridden method](https://codeql.github.com/codeql-query-help/python/py-init-calls-subclass/) | Reliability | Warning |
+| [`__init__` method is a generator](https://codeql.github.com/codeql-query-help/python/py-init-method-is-generator/) | Reliability | Error |
+| [`__init__` method returns a value](https://codeql.github.com/codeql-query-help/python/py-explicit-return-in-init/) | Reliability | Error |
+| [`__iter__` method returns a non-iterator](https://codeql.github.com/codeql-query-help/python/py-iter-returns-non-iterator/) | Reliability | Error |
+| [An assert statement has a side-effect](https://codeql.github.com/codeql-query-help/python/py-side-effect-in-assert/) | Reliability | Error |
+| [Asserting a tuple](https://codeql.github.com/codeql-query-help/python/py-asserts-tuple/) | Reliability | Error |
+| [Comparison using is when operands support `__eq__`](https://codeql.github.com/codeql-query-help/python/py-comparison-using-is/) | Reliability | Warning |
+| [Conflicting attributes in base classes](https://codeql.github.com/codeql-query-help/python/py-conflicting-attributes/) | Reliability | Warning |
+| [Empty except](https://codeql.github.com/codeql-query-help/python/py-empty-except/) | Reliability | Recommendation |
+| [Encoding error](https://codeql.github.com/codeql-query-help/python/py-encoding-error/) | Reliability | Error |
+| [Except block handles 'BaseException'](https://codeql.github.com/codeql-query-help/python/py-catch-base-exception/) | Reliability | Recommendation |
+| [Explicit export is not defined](https://codeql.github.com/codeql-query-help/python/py-undefined-export/) | Reliability | Error |
+| [Explicit returns mixed with implicit (fall through) returns](https://codeql.github.com/codeql-query-help/python/py-mixed-returns/) | Reliability | Recommendation |
+| [File is not always closed](https://codeql.github.com/codeql-query-help/python/py-file-not-closed/) | Reliability | Warning |
+| [First argument to super() is not enclosing class](https://codeql.github.com/codeql-query-help/python/py-super-not-enclosing-class/) | Reliability | Error |
+| [Formatted object is not a mapping](https://codeql.github.com/codeql-query-help/python/py-percent-format-not-mapping/) | Reliability | Error |
+| [Formatting string mixes implicitly and explicitly numbered fields](https://codeql.github.com/codeql-query-help/python/py-str-format-mixed-fields/) | Reliability | Error |
+| [Illegal raise](https://codeql.github.com/codeql-query-help/python/py-illegal-raise/) | Reliability | Error |
+| [Incomplete ordering](https://codeql.github.com/codeql-query-help/python/py-incomplete-ordering/) | Reliability | Warning |
+| [Inconsistent equality and hashing](https://codeql.github.com/codeql-query-help/python/py-equals-hash-mismatch/) | Reliability | Warning |
+| [Inconsistent equality and inequality](https://codeql.github.com/codeql-query-help/python/py-inconsistent-equality/) | Reliability | Warning |
+| [Inconsistent method resolution order](https://codeql.github.com/codeql-query-help/python/py-inconsistent-mro/) | Reliability | Error |
+| [Iterable can be either a string or a sequence](https://codeql.github.com/codeql-query-help/python/py-iteration-string-and-sequence/) | Reliability | Error |
+| [Iterator does not return self from `__iter__` method](https://codeql.github.com/codeql-query-help/python/py-iter-returns-non-self/) | Reliability | Error |
+| [Loop variable capture](https://codeql.github.com/codeql-query-help/python/py-loop-variable-capture/) | Reliability | Error |
+| [Maybe missing 'self' in comparison](https://codeql.github.com/codeql-query-help/python/py-comparison-missing-self/) | Reliability | Warning |
+| [Membership test with a non-container](https://codeql.github.com/codeql-query-help/python/py-member-test-non-container/) | Reliability | Error |
+| [Mismatch between signature and use of an overridden method](https://codeql.github.com/codeql-query-help/python/py-inheritance-incorrect-overridden-signature/) | Reliability | Recommendation |
+| [Mismatch between signature and use of an overriding method](https://codeql.github.com/codeql-query-help/python/py-inheritance-incorrect-overriding-signature/) | Reliability | Error |
+| [Mismatch in multiple assignment](https://codeql.github.com/codeql-query-help/python/py-mismatched-multiple-assignment/) | Reliability | Error |
+| [Missing call to superclass `__del__` during object destruction](https://codeql.github.com/codeql-query-help/python/py-missing-call-to-delete/) | Reliability | Error |
+| [Missing call to superclass `__init__` during object initialization](https://codeql.github.com/codeql-query-help/python/py-missing-call-to-init/) | Reliability | Error |
+| [Missing named arguments in formatting call](https://codeql.github.com/codeql-query-help/python/py-str-format-missing-named-argument/) | Reliability | Error |
+| [Missing part of special group in regular expression](https://codeql.github.com/codeql-query-help/python/py-regex-incomplete-special-group/) | Reliability | Warning |
+| [Modification of dictionary returned by locals()](https://codeql.github.com/codeql-query-help/python/py-modification-of-locals/) | Reliability | Warning |
+| [Modification of parameter with default](https://codeql.github.com/codeql-query-help/python/py-modification-of-default-value/) | Reliability | Error |
+| [Multiple calls to `__del__` during object destruction](https://codeql.github.com/codeql-query-help/python/py-multiple-calls-to-delete/) | Reliability | Warning |
+| [Multiple calls to `__init__` during object initialization](https://codeql.github.com/codeql-query-help/python/py-multiple-calls-to-init/) | Reliability | Warning |
+| [Mutation of descriptor in `__get__` or `__set__` method](https://codeql.github.com/codeql-query-help/python/py-mutable-descriptor/) | Reliability | Error |
+| [Nested loops with same variable reused after inner loop body](https://codeql.github.com/codeql-query-help/python/py-nested-loops-with-same-variable-reused/) | Reliability | Error |
+| [Non-callable called](https://codeql.github.com/codeql-query-help/python/py-call-to-non-callable/) | Reliability | Error |
+| [Non-exception in 'except' clause](https://codeql.github.com/codeql-query-help/python/py-useless-except/) | Reliability | Error |
+| [Non-iterable used in for loop](https://codeql.github.com/codeql-query-help/python/py-non-iterable-in-for-loop/) | Reliability | Error |
+| [Non-standard exception raised in special method](https://codeql.github.com/codeql-query-help/python/py-unexpected-raise-in-special-method/) | Reliability | Recommendation |
+| [Raising `NotImplemented`](https://codeql.github.com/codeql-query-help/python/py-raise-not-implemented/) | Reliability | Warning |
+| [Redundant assignment](https://codeql.github.com/codeql-query-help/python/py-redundant-assignment/) | Reliability | Error |
+| [Returning tuples with varying lengths](https://codeql.github.com/codeql-query-help/python/py-mixed-tuple-returns/) | Reliability | Recommendation |
+| [Signature mismatch in overriding method](https://codeql.github.com/codeql-query-help/python/py-inheritance-signature-mismatch/) | Reliability | Warning |
+| [Special method has incorrect signature](https://codeql.github.com/codeql-query-help/python/py-special-method-wrong-signature/) | Reliability | Error |
+| [Superclass attribute shadows subclass method](https://codeql.github.com/codeql-query-help/python/py-attribute-shadows-method/) | Reliability | Error |
+| [Suspicious unused loop iteration variable](https://codeql.github.com/codeql-query-help/python/py-unused-loop-variable/) | Reliability | Error |
+| [Syntax error](https://codeql.github.com/codeql-query-help/python/py-syntax-error/) | Reliability | Error |
+| [Testing equality to None](https://codeql.github.com/codeql-query-help/python/py-test-equals-none/) | Reliability | Recommendation |
+| [Too few arguments in formatting call](https://codeql.github.com/codeql-query-help/python/py-str-format-missing-argument/) | Reliability | Error |
+| [Unhashable object hashed](https://codeql.github.com/codeql-query-help/python/py-hash-unhashable-value/) | Reliability | Error |
+| [Unmatchable caret in regular expression](https://codeql.github.com/codeql-query-help/python/py-regex-unmatchable-caret/) | Reliability | Error |
+| [Unmatchable dollar in regular expression](https://codeql.github.com/codeql-query-help/python/py-regex-unmatchable-dollar/) | Reliability | Error |
+| [Unreachable `except` block](https://codeql.github.com/codeql-query-help/python/py-unreachable-except/) | Reliability | Error |
+| [Unsupported format character](https://codeql.github.com/codeql-query-help/python/py-percent-format-unsupported-character/) | Reliability | Error |
+| [Unused exception object](https://codeql.github.com/codeql-query-help/python/py-unused-exception-object/) | Reliability | Error |
+| [Use of a print statement at module level](https://codeql.github.com/codeql-query-help/python/py-print-during-import/) | Reliability | Recommendation |
+| [Use of exit() or quit()](https://codeql.github.com/codeql-query-help/python/py-use-of-exit-or-quit/) | Reliability | Warning |
+| [Wrong name for an argument in a call](https://codeql.github.com/codeql-query-help/python/py-call-wrong-named-argument/) | Reliability | Error |
+| [Wrong name for an argument in a class instantiation](https://codeql.github.com/codeql-query-help/python/py-call-wrong-named-class-argument/) | Reliability | Error |
+| [Wrong number of arguments for format](https://codeql.github.com/codeql-query-help/python/py-percent-format-wrong-arguments/) | Reliability | Error |
+| [Wrong number of arguments in a call](https://codeql.github.com/codeql-query-help/python/py-call-wrong-arguments/) | Reliability | Error |
+| [Wrong number of arguments in a class instantiation](https://codeql.github.com/codeql-query-help/python/py-call-wrong-number-class-arguments/) | Reliability | Error |
+
+{% endrowheaders %}
diff --git a/data/reusables/code-quality/codeql-query-tables/ruby.md b/data/reusables/code-quality/codeql-query-tables/ruby.md
new file mode 100644
index 000000000000..9e1532753e90
--- /dev/null
+++ b/data/reusables/code-quality/codeql-query-tables/ruby.md
@@ -0,0 +1,9 @@
+{% rowheaders %}
+
+| Query name | Category | Severity |
+| --- | --- | --- |
+| [Useless assignment to local variable](https://codeql.github.com/codeql-query-help/ruby/rb-useless-assignment-to-local/) | Maintainability | Warning |
+| [Database query in a loop](https://codeql.github.com/codeql-query-help/ruby/rb-database-query-in-loop/) | Reliability | Info |
+| [Potentially uninitialized local variable](https://codeql.github.com/codeql-query-help/ruby/rb-uninitialized-local-variable/) | Reliability | Error |
+
+{% endrowheaders %}
diff --git a/data/reusables/code-scanning/alerts-found-in-generated-code.md b/data/reusables/code-scanning/alerts-found-in-generated-code.md
index 3ddaeb6faa28..cd216e608db2 100644
--- a/data/reusables/code-scanning/alerts-found-in-generated-code.md
+++ b/data/reusables/code-scanning/alerts-found-in-generated-code.md
@@ -1,3 +1,3 @@
-For compiled languages like Java, Kotlin, Go, C, C++, and C#, {% data variables.product.prodname_codeql %} analyzes all of the code which was built during the workflow run. To limit the amount of code being analyzed, build only the code which you wish to analyze by specifying your own build steps in a `run` block. You can combine specifying your own build steps with using the `paths` or `paths-ignore` filters on the `pull_request` and `push` events to ensure that your workflow only runs when specific code is changed. For more information, see [AUTOTITLE](/actions/using-workflows/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore).
+When using `build-mode: autobuild` or `build-mode: manual`, for compiled languages like Java, Kotlin, Go, C, C++, and C#, {% data variables.product.prodname_codeql %} analyzes all of the code which was built during the workflow run. To limit the amount of code being analyzed, build only the code which you wish to analyze by specifying your own build steps in a `run` block. You can combine specifying your own build steps with using the `paths` or `paths-ignore` filters on the `pull_request` and `push` events to ensure that your workflow only runs when specific code is changed. For more information, see [AUTOTITLE](/actions/using-workflows/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore).
-For languages like JavaScript, Python, and TypeScript, that {% data variables.product.prodname_codeql %} analyzes without compiling the source code, you can specify additional configuration options to limit the amount of code to analyze. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-directories-to-scan).
+For languages like JavaScript, Python, and TypeScript, that {% data variables.product.prodname_codeql %} analyzes without compiling the source code, or for a compiled language using `build-mode: none`, you can specify additional configuration options to limit the amount of code to analyze. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-directories-to-scan).
diff --git a/data/reusables/code-scanning/choose-alert-dismissal-reason.md b/data/reusables/code-scanning/choose-alert-dismissal-reason.md
index b09bebf5b144..36ddfc3964eb 100644
--- a/data/reusables/code-scanning/choose-alert-dismissal-reason.md
+++ b/data/reusables/code-scanning/choose-alert-dismissal-reason.md
@@ -1 +1 @@
-It's important to choose the appropriate reason from the drop-down menu as this may affect whether a query continues to be included in future analysis. Optionally, you can comment on a dismissal to record the context of an alert dismissal. The dismissal comment is added to the alert timeline and can be used as justification during auditing and reporting. You can retrieve or set a comment by using the code scanning REST API. The comment is contained in `dismissed_comment` for the `alerts/{alert_number}` endpoint. For more information, see [AUTOTITLE](/rest/code-scanning#update-a-code-scanning-alert).
+It's important to choose the appropriate reason from the drop-down menu as this may affect whether a query continues to be included in future analysis. Optionally, you can comment on a dismissal to record the context of an alert dismissal. The dismissal comment is added to the alert timeline and can be used as justification during auditing and reporting. You can retrieve or set a comment by using the code scanning REST API. The comment is contained in `dismissed_comment` for the `alerts/{alert_number}` endpoint. For more information, see [AUTOTITLE](/rest/code-scanning/code-scanning#update-a-code-scanning-alert).
diff --git a/data/reusables/code-scanning/codeql-query-tables/csharp.md b/data/reusables/code-scanning/codeql-query-tables/csharp.md
index b70799069669..0e3183d00b62 100644
--- a/data/reusables/code-scanning/codeql-query-tables/csharp.md
+++ b/data/reusables/code-scanning/codeql-query-tables/csharp.md
@@ -7,6 +7,8 @@
| [ASP.NET config file enables directory browsing](https://codeql.github.com/codeql-query-help/csharp/cs-web-directory-browse-enabled/) | 548 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| [Assembly path injection](https://codeql.github.com/codeql-query-help/csharp/cs-assembly-path-injection/) | 114 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| [Clear text storage of sensitive information](https://codeql.github.com/codeql-query-help/csharp/cs-cleartext-storage-of-sensitive-information/) | 312, 315, 359 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
+| [Cookie 'HttpOnly' attribute is not set to true](https://codeql.github.com/codeql-query-help/csharp/cs-web-cookie-httponly-not-set/) | 1004 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
+| [Cookie 'Secure' attribute is not set to true](https://codeql.github.com/codeql-query-help/csharp/cs-web-cookie-secure-not-set/) | 319, 614 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
| [Cookie security: overly broad domain](https://codeql.github.com/codeql-query-help/csharp/cs-web-broad-cookie-domain/) | 287 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| [Cookie security: overly broad path](https://codeql.github.com/codeql-query-help/csharp/cs-web-broad-cookie-path/) | 287 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| [Cookie security: persistent cookie](https://codeql.github.com/codeql-query-help/csharp/cs-web-persistent-cookie/) | 539 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
diff --git a/data/reusables/code-scanning/codeql-query-tables/go.md b/data/reusables/code-scanning/codeql-query-tables/go.md
index 7bb25f200e8c..c08ffe20849a 100644
--- a/data/reusables/code-scanning/codeql-query-tables/go.md
+++ b/data/reusables/code-scanning/codeql-query-tables/go.md
@@ -7,6 +7,8 @@
| [Bad redirect check](https://codeql.github.com/codeql-query-help/go/go-bad-redirect-check/) | 601 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| [Clear-text logging of sensitive information](https://codeql.github.com/codeql-query-help/go/go-clear-text-logging/) | 312, 315, 359 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| [Command built from user-controlled sources](https://codeql.github.com/codeql-query-help/go/go-command-injection/) | 078 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
+| [Cookie 'HttpOnly' attribute is not set to true](https://codeql.github.com/codeql-query-help/go/go-cookie-httponly-not-set/) | 1004 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
+| [Cookie 'Secure' attribute is not set to true](https://codeql.github.com/codeql-query-help/go/go-cookie-secure-not-set/) | 614 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
| [Cross-site scripting via HTML template escaping bypass](https://codeql.github.com/codeql-query-help/go/go-html-template-escaping-bypass-xss/) | 079, 116 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
| [Database query built from user-controlled sources](https://codeql.github.com/codeql-query-help/go/go-sql-injection/) | 089 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| [Disabled TLS certificate check](https://codeql.github.com/codeql-query-help/go/go-disabled-certificate-check/) | 295 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
@@ -26,6 +28,8 @@
| [Suspicious characters in a regular expression](https://codeql.github.com/codeql-query-help/go/go-suspicious-character-in-regex/) | 020 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| [Uncontrolled data used in network request](https://codeql.github.com/codeql-query-help/go/go-request-forgery/) | 918 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
| [Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/go/go-path-injection/) | 022, 023, 036, 073, 099 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
+| [Use of a broken or weak cryptographic algorithm](https://codeql.github.com/codeql-query-help/go/go-weak-cryptographic-algorithm/) | 327, 328 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
+| [Use of a broken or weak cryptographic hashing algorithm on sensitive data](https://codeql.github.com/codeql-query-help/go/go-weak-sensitive-data-hashing/) | 327, 328, 916 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
| [Use of a weak cryptographic key](https://codeql.github.com/codeql-query-help/go/go-weak-crypto-key/) | 326 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| [Use of constant `state` value in OAuth 2.0 URL](https://codeql.github.com/codeql-query-help/go/go-constant-oauth2-state/) | 352 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| [Use of insecure HostKeyCallback implementation](https://codeql.github.com/codeql-query-help/go/go-insecure-hostkeycallback/) | 322 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
diff --git a/data/reusables/code-scanning/codeql-query-tables/links-to-all-tables.md b/data/reusables/code-scanning/codeql-query-tables/links-to-all-tables.md
index b202e9e78371..896c581f0d1c 100644
--- a/data/reusables/code-scanning/codeql-query-tables/links-to-all-tables.md
+++ b/data/reusables/code-scanning/codeql-query-tables/links-to-all-tables.md
@@ -1,13 +1,12 @@
{% ifversion code-scanning-actions-language %}
-* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/actions-built-in-queries)
+* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/actions-built-in-queries)
{% endif %}
-* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/c-cpp-built-in-queries)
-* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/csharp-built-in-queries)
-* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/github-actions-built-in-queries)
-* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/go-built-in-queries)
-* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/java-kotlin-built-in-queries)
-* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/javascript-typescript-built-in-queries)
-* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/python-built-in-queries)
-* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/ruby-built-in-queries)
-* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/rust-built-in-queries)
-* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/swift-built-in-queries)
+* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/c-cpp-built-in-queries)
+* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/csharp-built-in-queries)
+* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/go-built-in-queries)
+* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/java-kotlin-built-in-queries)
+* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/javascript-typescript-built-in-queries)
+* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/python-built-in-queries)
+* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/ruby-built-in-queries)
+* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/rust-built-in-queries)
+* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/swift-built-in-queries)
diff --git a/data/reusables/code-scanning/codeql-query-tables/rust.md b/data/reusables/code-scanning/codeql-query-tables/rust.md
index f18c7c47b8f5..44f52774c133 100644
--- a/data/reusables/code-scanning/codeql-query-tables/rust.md
+++ b/data/reusables/code-scanning/codeql-query-tables/rust.md
@@ -7,7 +7,9 @@
| [Cleartext logging of sensitive information](https://codeql.github.com/codeql-query-help/rust/rust-cleartext-logging/) | 312, 359, 532 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
| [Cleartext storage of sensitive information in a database](https://codeql.github.com/codeql-query-help/rust/rust-cleartext-storage-database/) | 312 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
| [Cleartext transmission of sensitive information](https://codeql.github.com/codeql-query-help/rust/rust-cleartext-transmission/) | 319 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
+| [Cross-site scripting](https://codeql.github.com/codeql-query-help/rust/rust-xss/) | 079, 116 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
| [Database query built from user-controlled sources](https://codeql.github.com/codeql-query-help/rust/rust-sql-injection/) | 089 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
+| [Disabled TLS certificate check](https://codeql.github.com/codeql-query-help/rust/rust-disabled-certificate-check/) | 295 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
| [Failure to use HTTPS URLs](https://codeql.github.com/codeql-query-help/rust/rust-non-https-url/) | 319, 345 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
| [Hard-coded cryptographic value](https://codeql.github.com/codeql-query-help/rust/rust-hard-coded-cryptographic-value/) | 259, 321, 798, 1204 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
| [Regular expression injection](https://codeql.github.com/codeql-query-help/rust/rust-regex-injection/) | 020, 074 | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} |
diff --git a/data/reusables/code-scanning/require-actions-ghcs.md b/data/reusables/code-scanning/require-actions-ghcs.md
index 5b4fe6630ef3..5f6a243284c9 100644
--- a/data/reusables/code-scanning/require-actions-ghcs.md
+++ b/data/reusables/code-scanning/require-actions-ghcs.md
@@ -1,3 +1,3 @@
-* {% data variables.product.prodname_actions %} are enabled.{% ifversion fpt or ghec %}
+* {% data variables.product.prodname_actions %} is enabled.{% ifversion fpt or ghec %}
* It is publicly visible, or {% data variables.product.prodname_GH_code_security %} is enabled.{%- elsif ghes %}
* {% data variables.product.prodname_GH_code_security %} is enabled.{% endif %}
diff --git a/data/reusables/codespaces/data-residency-availability.md b/data/reusables/codespaces/data-residency-availability.md
deleted file mode 100644
index 66a2b24fdd42..000000000000
--- a/data/reusables/codespaces/data-residency-availability.md
+++ /dev/null
@@ -1 +0,0 @@
->[!NOTE] {% data variables.product.prodname_github_codespaces %} is not available on subdomains of {% data variables.enterprise.data_residency_site %}, such as `octocorp.ghe.com`.
diff --git a/data/reusables/contributing/content-linter-rules.md b/data/reusables/contributing/content-linter-rules.md
index 68246a5a5045..9486cf26ed00 100644
--- a/data/reusables/contributing/content-linter-rules.md
+++ b/data/reusables/contributing/content-linter-rules.md
@@ -57,13 +57,14 @@
| GHD047 | table-column-integrity | Tables must have consistent column counts across all rows | error | tables, accessibility, formatting |
| GHD051 | frontmatter-versions-whitespace | Versions frontmatter should not contain unnecessary whitespace | error | frontmatter, versions |
| GHD054 | third-party-actions-reusable | Code examples with third-party actions must include disclaimer reusable | error | actions, reusable, third-party |
-| GHD056 | frontmatter-landing-recommended | Only landing pages can have recommended articles, there should be no duplicate recommended articles, and all recommended articles must exist | error | frontmatter, landing, recommended |
+| GHD056 | frontmatter-landing-carousels | Only landing pages can have carousels, there should be no duplicate articles, and all articles must exist | error | frontmatter, landing, carousels |
| GHD057 | ctas-schema | CTA URLs must conform to the schema | error | ctas, schema, urls |
| GHD058 | journey-tracks-liquid | Journey track properties must use valid Liquid syntax | error | frontmatter, journey-tracks, liquid |
| GHD059 | journey-tracks-guide-path-exists | Journey track guide paths must reference existing content files | error | frontmatter, journey-tracks |
| GHD060 | journey-tracks-unique-ids | Journey track IDs must be unique within a page | error | frontmatter, journey-tracks, unique-ids |
-| GHD061 | frontmatter-hero-image | Hero image paths must be absolute and point to valid images in /assets/images/banner-images/ | error | frontmatter, images |
+| GHD061 | frontmatter-hero-image | Hero image paths must be absolute, extensionless, and point to valid images in /assets/images/banner-images/ | error | frontmatter, images |
| GHD062 | frontmatter-intro-links | introLinks keys must be valid keys defined in data/ui.yml under product_landing | error | frontmatter, single-source |
+| GHD063 | frontmatter-children | Children frontmatter paths must exist. Supports relative paths and absolute /content/ paths for cross-product inclusion. | error | frontmatter, children |
| [search-replace](https://github.com/OnkarRuikar/markdownlint-rule-search-replace) | deprecated liquid syntax: octicon- | The octicon liquid syntax used is deprecated. Use this format instead `octicon "" aria-label=""` | error | |
| [search-replace](https://github.com/OnkarRuikar/markdownlint-rule-search-replace) | deprecated liquid syntax: site.data | Catch occurrences of deprecated liquid data syntax. | error | |
| [search-replace](https://github.com/OnkarRuikar/markdownlint-rule-search-replace) | developer-domain | Catch occurrences of developer.github.com domain. | error | |
diff --git a/data/reusables/copilot/access-copilot-metrics-dashboard.md b/data/reusables/copilot/access-copilot-metrics-dashboard.md
index 2eac48b5fc06..6a06eeb2df6d 100644
--- a/data/reusables/copilot/access-copilot-metrics-dashboard.md
+++ b/data/reusables/copilot/access-copilot-metrics-dashboard.md
@@ -1,3 +1,2 @@
1. Go to the [Enterprises](https://github.com/settings/enterprises) page and select your enterprise.
1. Click the **Insights** tab.
-1. In the left sidebar, click **{% data variables.product.prodname_copilot_short %} usage**.
diff --git a/data/reusables/copilot/byok-intro.md b/data/reusables/copilot/byok-intro.md
index 74fc03a47743..b20755c1cc1c 100644
--- a/data/reusables/copilot/byok-intro.md
+++ b/data/reusables/copilot/byok-intro.md
@@ -1,15 +1,16 @@
>[!NOTE]
>{% data reusables.copilot.byok-preview-note %}
->
->Some models require the Responses API which is not currently supported.
You can bring your own API keys to {% data variables.product.prodname_copilot %}, and enable teams to use your preferred large language model (LLM) providers with {% data variables.copilot.copilot_byok_supported_features %}.
API keys from the following providers are supported:
* Anthropic
+* AWS Bedrock
+* Google AI Studio
* Microsoft Foundry
* OpenAI
+* OpenAI-compatible providers
* xAI
Fine-tuned models are also supported, but functionality and quality of results can vary depending on the fine-tuning setup. You should test your model and review its outputs carefully before using it in production.
\ No newline at end of file
diff --git a/data/reusables/copilot/ce-product-callout.md b/data/reusables/copilot/ce-product-callout.md
deleted file mode 100644
index 9597e035efc7..000000000000
--- a/data/reusables/copilot/ce-product-callout.md
+++ /dev/null
@@ -1 +0,0 @@
-Organizations with a {% data variables.copilot.copilot_enterprise_short %} plan
diff --git a/data/reusables/copilot/change-the-ai-model-copilot-coding-agent.md b/data/reusables/copilot/change-the-ai-model-copilot-coding-agent.md
new file mode 100644
index 000000000000..6eed3e0c72c0
--- /dev/null
+++ b/data/reusables/copilot/change-the-ai-model-copilot-coding-agent.md
@@ -0,0 +1 @@
+You can change the model {% data variables.product.prodname_copilot_short %} uses. You may find that different models perform better, or provide more useful responses, depending on the type of task you give Copilot. See [AUTOTITLE](/copilot/how-tos/use-copilot-agents/coding-agent/changing-the-ai-model).
diff --git a/data/reusables/copilot/chat-previous-conversation.md b/data/reusables/copilot/chat-previous-conversation.md
deleted file mode 100644
index 9f12986f1657..000000000000
--- a/data/reusables/copilot/chat-previous-conversation.md
+++ /dev/null
@@ -1 +0,0 @@
-1. If the panel contains a previous conversation you had with {% data variables.product.prodname_copilot_short %}, click the {% octicon "plus" aria-hidden="true" aria-label="plus" %} plus sign icon at the top right of the {% data variables.product.prodname_copilot_short %} panel to start a new conversation.
diff --git a/data/reusables/copilot/ci-support-agents-all.md b/data/reusables/copilot/ci-support-agents-all.md
new file mode 100644
index 000000000000..de42772a4c32
--- /dev/null
+++ b/data/reusables/copilot/ci-support-agents-all.md
@@ -0,0 +1 @@
+š¤ Agent instructions (using AGENTS.md, CLAUDE.md or GEMINI.md files).
diff --git a/data/reusables/copilot/ci-support-agents-only.md b/data/reusables/copilot/ci-support-agents-only.md
new file mode 100644
index 000000000000..33b4e9fcef4b
--- /dev/null
+++ b/data/reusables/copilot/ci-support-agents-only.md
@@ -0,0 +1 @@
+š¤ Agent instructions (using an AGENTS.md file).
diff --git a/data/reusables/copilot/ci-support-organization.md b/data/reusables/copilot/ci-support-organization.md
new file mode 100644
index 000000000000..765a5db5b6d7
--- /dev/null
+++ b/data/reusables/copilot/ci-support-organization.md
@@ -0,0 +1 @@
+š¢ Organization instructions.
diff --git a/data/reusables/copilot/ci-support-path.md b/data/reusables/copilot/ci-support-path.md
new file mode 100644
index 000000000000..ddc4a5888d6e
--- /dev/null
+++ b/data/reusables/copilot/ci-support-path.md
@@ -0,0 +1 @@
+š Path-specific instructions (using .github/instructions/**/*.instructions.md files).
diff --git a/data/reusables/copilot/ci-support-personal.md b/data/reusables/copilot/ci-support-personal.md
new file mode 100644
index 000000000000..277ddfcf96a9
--- /dev/null
+++ b/data/reusables/copilot/ci-support-personal.md
@@ -0,0 +1 @@
+š¤ Personal instructions.
diff --git a/data/reusables/copilot/ci-support-repository.md b/data/reusables/copilot/ci-support-repository.md
new file mode 100644
index 000000000000..d9bbbd261365
--- /dev/null
+++ b/data/reusables/copilot/ci-support-repository.md
@@ -0,0 +1 @@
+š¦ Repository-wide instructions (using the .github/copilot-instructions.md file).
diff --git a/data/reusables/copilot/code-review/custom-instructions-information.md b/data/reusables/copilot/code-review/custom-instructions-information.md
index adc29e42a2a5..e35af5103f25 100644
--- a/data/reusables/copilot/code-review/custom-instructions-information.md
+++ b/data/reusables/copilot/code-review/custom-instructions-information.md
@@ -2,7 +2,7 @@ You can customize {% data variables.copilot.copilot_code-review_short %} by addi
Repository custom instructions can either be repository wide or path specific. You specify repository-wide custom instructions in a `.github/copilot-instructions.md` file in your repository. You can use this file to store information that you want {% data variables.product.prodname_copilot_short %} to consider when reviewing code anywhere in the repository.
-You can also write instructions that {% data variables.product.prodname_copilot_short %} will only use when reviewing code in files that match a specified path. You write these instructions in one or more `.github/instructions/**/NAME.instructions.md` files.
+You can also write instructions that {% data variables.product.prodname_copilot_short %} will only use when reviewing code in files that match a specified path. You write these instructions in one or more `.github/instructions/**/*.instructions.md` files.
For more information, see [AUTOTITLE](/copilot/customizing-copilot/adding-repository-custom-instructions-for-github-copilot).
diff --git a/data/reusables/copilot/coding-agent-emu-limitation.md b/data/reusables/copilot/coding-agent-emu-limitation.md
index f12b2c5bb0e2..3d1199a1562f 100644
--- a/data/reusables/copilot/coding-agent-emu-limitation.md
+++ b/data/reusables/copilot/coding-agent-emu-limitation.md
@@ -1,3 +1,3 @@
-{% data variables.copilot.copilot_coding_agent %} is not available in personal repositories owned by {% data variables.enterprise.prodname_managed_users %}. This is because {% data variables.copilot.copilot_coding_agent %} runs on {% data variables.product.company_short %}-hosted runners, which are not available to repositories owned by {% data variables.enterprise.prodname_managed_users %}. For more information, see [AUTOTITLE](/actions/using-github-hosted-runners/using-github-hosted-runners/about-github-hosted-runners).
+{% data variables.copilot.copilot_coding_agent %} is not available in personal repositories owned by {% data variables.enterprise.prodname_managed_users %}. This is because {% data variables.copilot.copilot_coding_agent %} runs on {% data variables.product.company_short %}-hosted runners, which are not available to personal repositories owned by {% data variables.enterprise.prodname_managed_users %}. For more information, see [AUTOTITLE](/actions/using-github-hosted-runners/using-github-hosted-runners/about-github-hosted-runners).
diff --git a/data/reusables/copilot/coding-agent/agent-management-intro.md b/data/reusables/copilot/coding-agent/agent-management-intro.md
index d4731bb8b73e..6cdf8cd973ea 100644
--- a/data/reusables/copilot/coding-agent/agent-management-intro.md
+++ b/data/reusables/copilot/coding-agent/agent-management-intro.md
@@ -1,4 +1 @@
-When utilizing {% data variables.product.github %}'s agentic features, you can use the [Agents tab](https://github.com/copilot/agents?ref_product=copilot&ref_type=engagement&ref_style=text) as a centralized control page where you can initiate, monitor, and manage agent tasks across {% data variables.product.github %}.
-
->[!NOTE]
-> The Agents tab is in public preview and subject to change.
+When utilizing {% data variables.product.github %}'s agentic features, you can use the **Agents** tab within a repository that has {% data variables.copilot.copilot_coding_agent %} enabled to initiate, monitor, and manage agent sessions without leaving your workflow. You can also use the [Agents page](https://github.com/copilot/agents?ref_product=copilot&ref_type=engagement&ref_style=text) to view and start agent sessions. To learn how to enable {% data variables.copilot.copilot_coding_agent %}, see [AUTOTITLE](/copilot/concepts/agents/coding-agent/access-management).
diff --git a/data/reusables/copilot/coding-agent/create-hooks-instructions.md b/data/reusables/copilot/coding-agent/create-hooks-instructions.md
new file mode 100644
index 000000000000..d72fc05da5d2
--- /dev/null
+++ b/data/reusables/copilot/coding-agent/create-hooks-instructions.md
@@ -0,0 +1,53 @@
+1. Create a new `hooks.json` file with the name of your choice in the `.github/hooks/` folder of your repository. The hooks configuration file **must be present** on your repository's default branch to be used by {% data variables.copilot.copilot_coding_agent %}. For {% data variables.copilot.copilot_cli %}, hooks are loaded from your current working directory.
+
+1. In your text editor, copy and paste the following hook template. Remove any hooks you don't plan on using from the `hooks` array.
+
+ ```json copy
+ {
+ "version": 1,
+ "hooks": {
+ "sessionStart": [...],
+ "sessionEnd": [...],
+ "userPromptSubmitted": [...],
+ "preToolUse": [...],
+ "postToolUse": [...],
+ "errorOccurred": [...]
+ }
+ }
+ ```
+
+1. Configure your hook syntax under the `bash` or `powershell` keys, or directly reference script files you have created.
+
+ * This example runs a script that outputs the start date of the session to a log file using the `sessionStart` hook:
+
+ ```json copy
+ "sessionStart": [
+ {
+ "type": "command",
+ "bash": "echo \"Session started: $(date)\" >> logs/session.log",
+ "powershell": "Add-Content -Path logs/session.log -Value \"Session started: $(Get-Date)\"",
+ "cwd": ".",
+ "timeoutSec": 10
+ }
+ ],
+ ```
+
+ * This example calls out to an external `log-prompt` script:
+
+ ```json copy
+ "userPromptSubmitted": [
+ {
+ "type": "command",
+ "bash": "./scripts/log-prompt.sh",
+ "powershell": "./scripts/log-prompt.ps1",
+ "cwd": "scripts",
+ "env": {
+ "LOG_LEVEL": "INFO"
+ }
+ }
+ ],
+ ```
+
+ For a full reference on the input JSON from agent sessions along with sample scripts, see [AUTOTITLE](/copilot/reference/hooks-configuration).
+
+1. Commit the file to the repository and merge it into the default branch. Your hooks will now run during agent sessions.
\ No newline at end of file
diff --git a/data/reusables/copilot/coding-agent/hooks-intro.md b/data/reusables/copilot/coding-agent/hooks-intro.md
new file mode 100644
index 000000000000..b29864ac987a
--- /dev/null
+++ b/data/reusables/copilot/coding-agent/hooks-intro.md
@@ -0,0 +1 @@
+Hooks allow you to extend and customize the behavior of {% data variables.product.prodname_copilot %} agents by executing custom shell commands at key points during agent execution. For a conceptual overview of hooks, see [AUTOTITLE](/copilot/concepts/agents/coding-agent/about-hooks).
diff --git a/data/reusables/copilot/coding-agent/new-agent-task-form-instructions.md b/data/reusables/copilot/coding-agent/new-agent-task-form-instructions.md
index 95691361f782..3283372f57e0 100644
--- a/data/reusables/copilot/coding-agent/new-agent-task-form-instructions.md
+++ b/data/reusables/copilot/coding-agent/new-agent-task-form-instructions.md
@@ -5,6 +5,7 @@
1. Optionally, select a base branch for {% data variables.product.prodname_copilot_short %}'s pull request. {% data variables.product.prodname_copilot_short %} will create a new branch based on this branch, then push the changes to a pull request targeting that branch.
1. {% data reusables.copilot.optional-select-custom-agent %}
+{% data reusables.copilot.optional-select-copilot-coding-agent-model %}
1. Click **{% octicon "paper-airplane" aria-label="Start task" %} Start task** or press Return.
{% data variables.product.prodname_copilot_short %} will start a new session, which will appear in the list below the prompt box. {% data variables.product.prodname_copilot_short %} will work on the task and push changes to its pull request, then add you as a reviewer when it has finished, triggering a notification.
diff --git a/data/reusables/copilot/coding-agent/troubleshoot-hooks.md b/data/reusables/copilot/coding-agent/troubleshoot-hooks.md
new file mode 100644
index 000000000000..4c5ba983c708
--- /dev/null
+++ b/data/reusables/copilot/coding-agent/troubleshoot-hooks.md
@@ -0,0 +1,35 @@
+If you run into problems using hooks, use the following table to troubleshoot.
+
+| Issue | Action |
+| --- | --- |
+| Hooks are not executing | - Verify the JSON file is in the `.github/hooks/` directory.
- Check for valid JSON syntax (for example, `jq . hooks.json`).
- Ensure `version: 1` is specified in your `hooks.json` file.
- Verify the script you are calling from your hook is executable (`chmod +x script.sh`)
- Check that the script has a proper shebang (for example, `#!/bin/bash`)
|
+| Hooks are timing out | - The default timeout is 30 seconds. Increase `timeoutSec` in the configuration if needed.
- Optimize script performance by avoiding unnecessary operations.
|
+| Invalid JSON output | - Ensure the output is on a single line.
- On Unix, use `jq -c` to compact and validate the JSON output.
- On Windows, use the `ConvertTo-Json -Compress` command in PowerShell to do the same.
|
+
+## Debugging
+
+You can debug hooks using the following methods:
+
+* **Enable verbose logging** in the script to inspect the input data and trace script execution.
+
+ ```shell copy
+ #!/bin/bash
+ set -x # Enable bash debug mode
+ INPUT=$(cat)
+ echo "DEBUG: Received input" >&2
+ echo "$INPUT" >&2
+ # ... rest of script
+ ```
+
+* **Test hooks locally** by piping test input into your hook to validate its behavior:
+
+ ```shell copy
+ # Create test input
+ echo '{"timestamp":1704614400000,"cwd":"/tmp","toolName":"bash","toolArgs":"{\"command\":\"ls\"}"}' | ./my-hook.sh
+
+ # Check exit code
+ echo $?
+
+ # Validate output is valid JSON
+ ./my-hook.sh | jq .
+ ```
\ No newline at end of file
diff --git a/data/reusables/copilot/copilot-coding-agent-auto-models.md b/data/reusables/copilot/copilot-coding-agent-auto-models.md
new file mode 100644
index 000000000000..21288f718ff9
--- /dev/null
+++ b/data/reusables/copilot/copilot-coding-agent-auto-models.md
@@ -0,0 +1,2 @@
+* {% data variables.copilot.copilot_claude_sonnet_45 %}
+* {% data variables.copilot.copilot_gpt_51_codex_max %}
\ No newline at end of file
diff --git a/data/reusables/copilot/copilot-coding-agent-non-auto-models.md b/data/reusables/copilot/copilot-coding-agent-non-auto-models.md
new file mode 100644
index 000000000000..b72bcb580ed9
--- /dev/null
+++ b/data/reusables/copilot/copilot-coding-agent-non-auto-models.md
@@ -0,0 +1,2 @@
+* {% data variables.copilot.copilot_claude_opus_45 %}
+* {% data variables.copilot.copilot_gpt_52_codex %}
diff --git a/data/reusables/copilot/custom-instructions-about.md b/data/reusables/copilot/custom-instructions-about.md
index bd8260771ea1..3e8b06343bc0 100644
--- a/data/reusables/copilot/custom-instructions-about.md
+++ b/data/reusables/copilot/custom-instructions-about.md
@@ -4,7 +4,7 @@
* **Path-specific custom instructions**, which apply to requests made in the context of files that match a specified path.
- These are specified in one or more `NAME.instructions.md` files within the `.github/instructions` directory in the repository.
+ These are specified in one or more `NAME.instructions.md` files within or below the `.github/instructions` directory in the repository.
By using path-specific instructions you can avoid overloading your repository-wide instructions with information that only applies to files of certain types, or in certain directories.
@@ -12,6 +12,6 @@
These are specified in files called `AGENTS.md`, `CLAUDE.md`, or `GEMINI.md`.
-See the table below for details of support for each of these types of repository custom instructions across different {% data variables.product.prodname_copilot_short %} features.
+For details of support for each of these types of repository custom instructions across different {% data variables.product.prodname_copilot_short %} features, see [AUTOTITLE](/copilot/reference/custom-instructions-support).
For a curated collection of examples, see [AUTOTITLE](/copilot/tutorials/customization-library/custom-instructions).
diff --git a/data/reusables/copilot/custom-instructions-note.md b/data/reusables/copilot/custom-instructions-note.md
new file mode 100644
index 000000000000..b4d8c57e0ca9
--- /dev/null
+++ b/data/reusables/copilot/custom-instructions-note.md
@@ -0,0 +1,11 @@
+{% note %}
+
+Did you successfully add a custom instructions file to your repository?
+
+Yes No
+
+{% endnote %}
+
+## Repository custom instructions in use
+
+The instructions in the file(s) are available for use by {% data variables.product.prodname_copilot_short %} as soon as you save the file(s). The complete set of instructions will be automatically added to requests that you submit to {% data variables.product.prodname_copilot_short %} in the context of that repository. For example, they are added to the prompt you submit to {% data variables.copilot.copilot_chat_short %}.
diff --git a/data/reusables/copilot/differences-cfi-cfb-table.md b/data/reusables/copilot/differences-cfi-cfb-table.md
index 62f95a2f2091..dba95f7a3c94 100644
--- a/data/reusables/copilot/differences-cfi-cfb-table.md
+++ b/data/reusables/copilot/differences-cfi-cfb-table.md
@@ -14,7 +14,7 @@
| Agents | {% data variables.copilot.copilot_free_short %} | {% data variables.copilot.copilot_pro_short %} | {% data variables.copilot.copilot_pro_plus_short %} | {% data variables.copilot.copilot_business_short %} | {% data variables.copilot.copilot_enterprise_short %} |
| --- | --- | --- | --- | --- | --- |
-| {% data variables.copilot.copilot_coding_agent %} ({% data variables.release-phases.public_preview %}) | {% octicon "x" aria-label="Not included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
+| {% data variables.copilot.copilot_coding_agent %} | {% octicon "x" aria-label="Not included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| Agent mode | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| {% data variables.product.prodname_copilot_short %} code review | Only "Review selection" in {% data variables.product.prodname_vscode_shortname %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| Model Context Protocol (MCP) | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
@@ -78,7 +78,6 @@
| {% data variables.copilot.copilot_for_prs %} | {% octicon "x" aria-label="Not included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| Audit logs | {% octicon "x" aria-label="Not included" %} | {% octicon "x" aria-label="Not included" %} |{% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| Content exclusion | {% octicon "x" aria-label="Not included" %} | {% octicon "x" aria-label="Not included" %} | {% octicon "x" aria-label="Not included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
-| {% data variables.product.prodname_copilot_short %} knowledge bases |{% octicon "x" aria-label="Not included" %} | {% octicon "x" aria-label="Not included" %} | {% octicon "x" aria-label="Not included" %} | {% octicon "x" aria-label="Not included" %} | {% octicon "check" aria-label="Included" %} |
| {% data variables.copilot.copilot_cli_short %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "check" aria-label="Included" %} |
| {% data variables.product.prodname_spark %} ({% data variables.release-phases.public_preview %}) | {% octicon "x" aria-label="Not included" %} | {% octicon "x" aria-label="Not included" %} | {% octicon "check" aria-label="Included" %} | {% octicon "x" aria-label="Not included" %} | {% octicon "check" aria-label="Included" %} |
diff --git a/data/reusables/copilot/knowledge-bases-retirement.md b/data/reusables/copilot/knowledge-bases-retirement.md
deleted file mode 100644
index 46cb9ea6be1e..000000000000
--- a/data/reusables/copilot/knowledge-bases-retirement.md
+++ /dev/null
@@ -1,2 +0,0 @@
-> [!IMPORTANT]
-> Beginning November 1, 2025, knowledge bases will be {% data variables.release-phases.retired %} and fully replaced by {% data variables.copilot.copilot_spaces %}. {% data variables.copilot.copilot_spaces_short %} let you combine code and free-text contentālike transcripts or specsāand can be created by any {% data variables.product.prodname_copilot_short %} user, not just organization owners. They're a good option for more focused or task-specific use cases. See [AUTOTITLE](/copilot/using-github-copilot/copilot-spaces/about-organizing-and-sharing-context-with-copilot-spaces).
diff --git a/data/reusables/copilot/metrics-api-ghecom.md b/data/reusables/copilot/metrics-api-ghecom.md
deleted file mode 100644
index ce6f064b635f..000000000000
--- a/data/reusables/copilot/metrics-api-ghecom.md
+++ /dev/null
@@ -1 +0,0 @@
->[!NOTE] The {% data variables.product.prodname_copilot_short %} metrics endpoints are **not** available for {% data variables.enterprise.data_residency %} on {% data variables.enterprise.data_residency_site %}.
diff --git a/data/reusables/copilot/model-use-cases/gpt-5.md b/data/reusables/copilot/model-use-cases/gpt-5.md
deleted file mode 100644
index 7a59405da965..000000000000
--- a/data/reusables/copilot/model-use-cases/gpt-5.md
+++ /dev/null
@@ -1 +0,0 @@
- {% data variables.copilot.copilot_gpt_5 %} supports image input so that developers can bring visual context into tasks like UI inspection, diagram analysis, or layout debugging. This makes {% data variables.copilot.copilot_gpt_5 %} particularly useful for scenarios where image-based input enhances problem-solving, such as asking {% data variables.product.prodname_copilot_short %} to analyze a UI screenshot for accessibility issues or to help understand a visual bug in a layout.
diff --git a/data/reusables/copilot/model-use-cases/gpt-52.md b/data/reusables/copilot/model-use-cases/gpt-52.md
new file mode 100644
index 000000000000..4034110a9bdd
--- /dev/null
+++ b/data/reusables/copilot/model-use-cases/gpt-52.md
@@ -0,0 +1 @@
+ {% data variables.copilot.copilot_gpt_52 %} supports image input so that developers can bring visual context into tasks like UI inspection, diagram analysis, or layout debugging. This makes {% data variables.copilot.copilot_gpt_52 %} particularly useful for scenarios where image-based input enhances problem-solving, such as asking {% data variables.product.prodname_copilot_short %} to analyze a UI screenshot for accessibility issues or to help understand a visual bug in a layout.
diff --git a/data/reusables/copilot/open-agents-panel-or-page.md b/data/reusables/copilot/open-agents-panel-or-page.md
index d38706d05205..e155f4fe6356 100644
--- a/data/reusables/copilot/open-agents-panel-or-page.md
+++ b/data/reusables/copilot/open-agents-panel-or-page.md
@@ -1,4 +1,5 @@
1. Open the agents panel or tab:
+ * Open the **{% octicon "agent" aria-label="The Agents icon" %} Agents** tab in a repository.
+ * **Navigate to the agents page**: Go to [github.com/copilot/agents](https://github.com/copilot/agents?ref_product=copilot&ref_type=engagement&ref_style=text). You can also get here by opening the agents panel, then clicking **View all**.
* **Open the agents panel**: Click {% octicon "agent" aria-label="The Agents icon" %} in the navigation bar at the top right of {% data variables.product.github %}.
- * **Navigate to the agents tab**: Go to [github.com/copilot/agents](https://github.com/copilot/agents?ref_product=copilot&ref_type=engagement&ref_style=text). You can also get here by opening the agents panel, then clicking **View all**.
diff --git a/data/reusables/copilot/optional-select-copilot-coding-agent-model.md b/data/reusables/copilot/optional-select-copilot-coding-agent-model.md
new file mode 100644
index 000000000000..7e14bea59112
--- /dev/null
+++ b/data/reusables/copilot/optional-select-copilot-coding-agent-model.md
@@ -0,0 +1 @@
+1. Optionally, if you are a {% data variables.copilot.copilot_pro %} or {% data variables.copilot.copilot_pro_plus %} user, you can use the dropdown menu to select the model that {% data variables.product.prodname_copilot_short %} will use. For more information, see [AUTOTITLE](/copilot/how-tos/use-copilot-agents/coding-agent/changing-the-ai-model).
\ No newline at end of file
diff --git a/data/reusables/copilot/org-copilot-usage-metrics.md b/data/reusables/copilot/org-copilot-usage-metrics.md
new file mode 100644
index 000000000000..37ce071b9cfd
--- /dev/null
+++ b/data/reusables/copilot/org-copilot-usage-metrics.md
@@ -0,0 +1 @@
+> [!NOTE] The {% data variables.product.prodname_copilot_short %} usage metrics dashboard reports data at the enterprise level. Organization-level metrics are available through the {% data variables.product.prodname_copilot_short %} usage metrics APIs only. See [AUTOTITLE](/rest/copilot/copilot-usage-metrics).
diff --git a/data/reusables/copilot/prompt-files-available-in-editors.md b/data/reusables/copilot/prompt-files-available-in-editors.md
index 0d0cb3b07460..ab603037bc2b 100644
--- a/data/reusables/copilot/prompt-files-available-in-editors.md
+++ b/data/reusables/copilot/prompt-files-available-in-editors.md
@@ -1 +1 @@
-Prompt files are only available in {% data variables.product.prodname_vscode_shortname %} and JetBrains IDEs.
+Prompt files are only available in {% data variables.product.prodname_vscode_shortname %}, {% data variables.product.prodname_vs %}, and JetBrains IDEs.
diff --git a/data/reusables/copilot/prompt-files-preview-note.md b/data/reusables/copilot/prompt-files-preview-note.md
index cb307a278f56..b2ee104b4e8c 100644
--- a/data/reusables/copilot/prompt-files-preview-note.md
+++ b/data/reusables/copilot/prompt-files-preview-note.md
@@ -1,3 +1,3 @@
> [!NOTE]
-> * {% data variables.product.prodname_copilot_short %} prompt files are in {% data variables.release-phases.public_preview %} and subject to change. {% data reusables.copilot.prompt-files-available-in-editors %} See [AUTOTITLE](/copilot/concepts/prompting/response-customization?tool=vscode#about-prompt-files).
+> * {% data variables.product.prodname_copilot_short %} prompt files are in {% data variables.release-phases.public_preview %} and subject to change. {% data reusables.copilot.prompt-files-available-in-editors %} See [AUTOTITLE](/copilot/concepts/prompting/response-customization#about-prompt-files).
> * For community-contributed examples of prompt files for specific languages and scenarios, see the [Awesome GitHub Copilot Customizations](https://github.com/github/awesome-copilot/blob/main/docs/README.prompts.md) repository.
diff --git a/data/reusables/copilot/repository-custom-instructions-support.md b/data/reusables/copilot/repository-custom-instructions-support.md
deleted file mode 100644
index 0e896c8e99e0..000000000000
--- a/data/reusables/copilot/repository-custom-instructions-support.md
+++ /dev/null
@@ -1,25 +0,0 @@
-### Support for repository custom instructions
-
-The following table shows which {% data variables.product.prodname_copilot_short %} features support custom instructions in various environments.
-
-{% rowheaders %}
-
-| | Eclipse | JetBrains IDEs | {% data variables.product.prodname_vs %} | {% data variables.product.prodname_vscode_shortname %} | {% data variables.product.prodname_dotcom_the_website %} | Xcode |
-| --- | --- | --- | --- | --- | --- | --- |
-| {% data variables.copilot.copilot_chat_short %} | {% octicon "check" aria-label="Included" %} 1 | {% octicon "check" aria-label="Included" %} 1 | {% octicon "check" aria-label="Included" %} 1 | {% octicon "check" aria-label="Included" %} 3 | {% octicon "check" aria-label="Included" %} 1 | {% octicon "check" aria-label="Included" %} 1 |
-| {% data variables.copilot.copilot_coding_agent %} | N/A | N/A | N/A | {% octicon "check" aria-label="Included" %} 4 | {% octicon "check" aria-label="Included" %} 4 | N/A |
-| {% data variables.copilot.copilot_code-review_short %} | N/A | {% octicon "x" aria-label="Not included" %} | {% octicon "check" aria-label="Included" %} 1 | {% octicon "check" aria-label="Included" %} 1 | {% octicon "check" aria-label="Included" %} 2 | {% octicon "x" aria-label="Not included" %} |
-
-{% endrowheaders %}
-
-**Types of custom instructions supported**
-
-**1:** Repository-wide instructions (using the `.github/copilot-instructions.md` file).
-**2:** Repository-wide instructions and path-specific instructions (using `.github/instructions/**/NAME.instructions.md` files).
-**3:** Repository-wide instructions, path-specific instructions, and agent instructions (using `AGENTS.md` files).
-**4:** Repository-wide instructions, path-specific instructions, and agent instructions (using `AGENTS.md`, `CLAUDE.md` or `GEMINI.md` files).
-**X:** Custom instructions are not supported.
-**N/A:** Feature not available on this platform.
-
-> [!NOTE]
-> {% data variables.copilot.copilot_code-review_short %} only reads the first 4,000 characters of any custom instruction file. Any instructions beyond this limit will not affect the reviews generated by {% data variables.copilot.copilot_code-review_short %}. This limit does not apply to {% data variables.copilot.copilot_chat_short %} or {% data variables.copilot.copilot_coding_agent %}.
diff --git a/data/reusables/copilot/repository-custom-instructions-types.md b/data/reusables/copilot/repository-custom-instructions-types.md
index f3ab16a7985a..3a3b988d7306 100644
--- a/data/reusables/copilot/repository-custom-instructions-types.md
+++ b/data/reusables/copilot/repository-custom-instructions-types.md
@@ -1,4 +1,4 @@
You can create repository custom instructions in two ways:
* **Repository-wide instructions**: Create a single `copilot-instructions.md` file at the repository root that applies to all files in the repository.
-* **Path-specific instructions**: Create one or more `.instructions.md` files with an `applyTo` field that apply only to specific files or directories. Path-specific instructions are currently supported for **{% data variables.copilot.copilot_chat_short %}** in {% data variables.product.prodname_vscode %} and **{% data variables.product.prodname_copilot %} coding agent**.
+* **Path-specific instructions**: Create one or more `.instructions.md` files with an `applyTo` field that apply only to specific files or directories. Path-specific instructions are currently supported for **{% data variables.copilot.copilot_chat_short %}** in {% data variables.product.prodname_vscode %}, {% data variables.product.prodname_vs %}, and **{% data variables.product.prodname_copilot %} coding agent**.
diff --git a/data/reusables/copilot/using-subagents.md b/data/reusables/copilot/using-subagents.md
index e8b913dd2e2e..866cca8e1de3 100644
--- a/data/reusables/copilot/using-subagents.md
+++ b/data/reusables/copilot/using-subagents.md
@@ -1,10 +1,13 @@
-{% data variables.copilot.subagents_caps_short %} can be invoked in different ways:
+{% data variables.copilot.subagents_caps_short %} can be invoked in different ways:
* **Automatic delegation**. {% data variables.product.prodname_copilot_short %} will analyze the description of your request, the description field of your configured {% data variables.copilot.custom_agents_short %}, and the current context and available tools to automatically choose a {% data variables.copilot.subagent_short %}. For example, this prompt would automatically delegate the task to a **refactor-specialist** {% data variables.copilot.copilot_custom_agent_short %}:
+
```text
Suggest ways to refactor this legacy code.
```
+
* **Direct invocation**. You can directly call the {% data variables.copilot.subagent_short %} in your prompt:
+
```text
Use the testing subagent to write unit tests for the authentication module.
```
\ No newline at end of file
diff --git a/data/reusables/data-residency/when-you-adopt-data-residency.md b/data/reusables/data-residency/when-you-adopt-data-residency.md
index d2301cbc0b41..3f34c59e575b 100644
--- a/data/reusables/data-residency/when-you-adopt-data-residency.md
+++ b/data/reusables/data-residency/when-you-adopt-data-residency.md
@@ -7,5 +7,6 @@ The available regions are:
* EU
* Australia
* US
+* Japan
In the future, {% data variables.product.github %} plans to offer {% data variables.enterprise.data_residency_short %} in more regions.
diff --git a/data/reusables/dependabot/community-maintained-intro.md b/data/reusables/dependabot/community-maintained-intro.md
new file mode 100644
index 000000000000..3ada7ee51797
--- /dev/null
+++ b/data/reusables/dependabot/community-maintained-intro.md
@@ -0,0 +1 @@
+The following ecosystems are maintained by their upstream community maintainers. {% data variables.product.github %} integrates {% data variables.product.prodname_dependabot %} with these ecosystems but does not maintain them directly.
diff --git a/data/reusables/dependabot/dependabot-alert-actions-semver.md b/data/reusables/dependabot/dependabot-alert-actions-semver.md
index c178039bb022..3c799ff350e2 100644
--- a/data/reusables/dependabot/dependabot-alert-actions-semver.md
+++ b/data/reusables/dependabot/dependabot-alert-actions-semver.md
@@ -1 +1 @@
-{% data variables.product.prodname_dependabot %} will only create {% data variables.product.prodname_dependabot_alerts %} for vulnerable {% data variables.product.prodname_actions %} that use semantic versioning. You will not receive alerts for a vulnerable action that uses SHA versioning. If you use {% data variables.product.prodname_actions %} with SHA versioning, we recommend enabling {% data variables.product.prodname_dependabot_version_updates %} for your repository or organization to keep the actions you use updated to the latest versions.
+For {% data variables.product.prodname_actions %}, {% data variables.product.prodname_dependabot_alerts %} are only generated for actions that use semantic versioning, not SHA versioning.
diff --git a/data/reusables/dependabot/dependabot-alert-create-PR.md b/data/reusables/dependabot/dependabot-alert-create-PR.md
deleted file mode 100644
index c0ac1d7d5069..000000000000
--- a/data/reusables/dependabot/dependabot-alert-create-PR.md
+++ /dev/null
@@ -1 +0,0 @@
-If you have enabled {% data variables.product.prodname_dependabot_security_updates %} for your repository, the alert may also contain a link to a pull request to update the manifest or lock file to the minimum version that resolves the vulnerability. For more information, see [AUTOTITLE](/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates).
diff --git a/data/reusables/dependabot/dependabot-on-actions-future-note.md b/data/reusables/dependabot/dependabot-on-actions-future-note.md
deleted file mode 100644
index dd65e6e8934a..000000000000
--- a/data/reusables/dependabot/dependabot-on-actions-future-note.md
+++ /dev/null
@@ -1 +0,0 @@
-> [!NOTE] Future releases of {% data variables.product.prodname_dotcom %} will always run {% data variables.product.prodname_dependabot %} using {% data variables.product.prodname_actions %}, and you will no longer have the option to enable or disable this setting.
diff --git a/data/reusables/dependabot/enabling-disabling-dependency-graph-private-repo-public-fork.md b/data/reusables/dependabot/enabling-disabling-dependency-graph-private-repo-public-fork.md
index d21724a7f473..e1c38ac87f53 100644
--- a/data/reusables/dependabot/enabling-disabling-dependency-graph-private-repo-public-fork.md
+++ b/data/reusables/dependabot/enabling-disabling-dependency-graph-private-repo-public-fork.md
@@ -1,7 +1,3 @@
-Repository administrators can enable or disable the dependency graph for all repositories owned by your user account, regardless of their visibility. See [AUTOTITLE](/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-user-account-settings/managing-security-and-analysis-settings-for-your-personal-account).
-
-You can also enable the dependency graph for multiple repositories in an organization at the same time. For more information, see {% ifversion security-configurations %}[AUTOTITLE](/code-security/securing-your-organization).{% else %}[AUTOTITLE](/code-security/getting-started/quickstart-for-securing-your-organization).{% endif %}
-
{% data reusables.repositories.navigate-to-repo %}
{% data reusables.repositories.sidebar-settings %}
{% data reusables.repositories.navigate-to-code-security-and-analysis %}
diff --git a/data/reusables/dependabot/ghes-enabling-dependency-graph.md b/data/reusables/dependabot/ghes-enabling-dependency-graph.md
index 9dc8c461b5a2..855766f3db11 100644
--- a/data/reusables/dependabot/ghes-enabling-dependency-graph.md
+++ b/data/reusables/dependabot/ghes-enabling-dependency-graph.md
@@ -1 +1 @@
-If the dependency graph is not available in your system, your enterprise owner can enable the dependency graph. For more information, see [AUTOTITLE](/admin/code-security/managing-supply-chain-security-for-your-enterprise/enabling-the-dependency-graph-for-your-enterprise).
+If the dependency graph is not available on your {% data variables.product.prodname_ghe_server %} instance, ask an enterprise owner to enable it. For more information, see [AUTOTITLE](/admin/code-security/managing-supply-chain-security-for-your-enterprise/enabling-the-dependency-graph-for-your-enterprise).
diff --git a/data/reusables/dependabot/no-ubuntu-latest-label-self-hosted.md b/data/reusables/dependabot/no-ubuntu-latest-label-self-hosted.md
new file mode 100644
index 000000000000..fd20ad046f68
--- /dev/null
+++ b/data/reusables/dependabot/no-ubuntu-latest-label-self-hosted.md
@@ -0,0 +1,2 @@
+> [!NOTE]
+> {% data variables.product.prodname_dependabot %} on {% data variables.product.prodname_actions %} relies on the `ubuntu-latest` label to select the appropriate runner. To ensure {% data variables.product.prodname_dependabot %} runs on {% data variables.product.github %}-hosted runners, you should not use the label `ubuntu-latest` for self-hosted runners.
diff --git a/data/reusables/dependabot/pull-request-introduction.md b/data/reusables/dependabot/pull-request-introduction.md
deleted file mode 100644
index ceb23738f2a7..000000000000
--- a/data/reusables/dependabot/pull-request-introduction.md
+++ /dev/null
@@ -1 +0,0 @@
-{% data variables.product.prodname_dependabot %} raises pull requests to update dependencies. Depending on how your repository is configured, {% data variables.product.prodname_dependabot %} may raise pull requests for version updates and/or for security updates. You manage these pull requests in the same way as any other pull request, but there are also some extra commands available. For information about enabling {% data variables.product.prodname_dependabot %} dependency updates, see [AUTOTITLE](/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates) and [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates).
diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md
index 4f8fb4296ebc..4da4a7de5688 100644
--- a/data/reusables/dependabot/supported-package-managers.md
+++ b/data/reusables/dependabot/supported-package-managers.md
@@ -2,6 +2,9 @@
Package manager | YAML value | Supported versions | Version updates | Security updates | Private repositories | Private registries | Vendoring |
---------------|------------------|------------------|:---:|:---:|:---:|:---:|:---:|
+| {% ifversion dependabot-bazel-support %} |
+Bazel | `bazel` | v7, v8, v9 | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
+| {% endif %} |
| {% ifversion dependabot-bun-support %} |
[Bun](#bun) | `bun` | >=v1.1.39 | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} |
| {% endif %} |
@@ -21,6 +24,9 @@ Composer | `composer` | {% ifversion dependabot-updates-composerv1-c
| {% endif %} |
[Helm Charts](#helm-charts) | `helm` | {% ifversion dependabot-helm-support %}v3{% else %}Not supported{% endif %} | {% ifversion dependabot-helm-support %}{% octicon "check" aria-label="Supported" %}{% else %}{% octicon "x" aria-label="Not supported" %}{% endif %} | {% octicon "x" aria-label="Not supported" %} | {% ifversion dependabot-helm-support %}{% octicon "check" aria-label="Supported" %}{% else %}{% octicon "x" aria-label="Not supported" %}{% endif %} | {% ifversion dependabot-helm-support %}{% octicon "check" aria-label="Supported" %}{% else %}{% octicon "x" aria-label="Not supported" %}{% endif %} | Not applicable |
Hex | `mix` | v1 | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} |
+| {% ifversion dependabot-julia-support %} |
+[Julia](#julia) | `julia` | >=v1.10 | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
+| {% endif %} |
elm-package | `elm` | v0.19 | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} |
git submodule | `gitsubmodule` | Not applicable | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | Not applicable |
[{% data variables.product.prodname_actions %}](#github-actions) | `github-actions` | Not applicable | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | Not applicable |
@@ -29,6 +35,9 @@ Go modules | `gomod` | v1 | {% octicon "check" aria-l
[Maven](#maven) | `maven` | Not applicable | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} |
npm | `npm` | v7, v8, v9, v10, v11 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} |
[NuGet](#nuget-cli) | `nuget` | {% ifversion fpt or ghec or ghes > 3.14 %}<=6.12.0{% endif %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} |
+| {% ifversion dependabot-opentofu-support %} |
+[OpenTofu](#opentofu) | `opentofu` | Not applicable | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | Not applicable |
+| {% endif %} |
[pip](#pip-and-pip-compile) | `pip` | v21.1.2 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} |
pipenv | `pip` | <= 2021-05-29 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} |
[pip-compile](#pip-and-pip-compile) | `pip` | 6.1.0 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} |
@@ -40,7 +49,7 @@ poetry | `pip` | v1 | {% octicon "check" aria-l
| {% endif %} |
[Swift](#swift) | `swift` | v5 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} (git only) | {% octicon "x" aria-label="Not supported" %} |
[Terraform](#terraform) | `terraform` | >= 0.13, <= 1.13.x | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | Not applicable |
-uv | `uv` | v0 | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | Not applicable |
+uv | `uv` | v0 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | Not applicable |
| {% ifversion dependabot-vcpkg-support %} |
[vcpkg](#vcpkg) | `vcpkg` | Not applicable | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | Not applicable |
| {% endif %} |
@@ -53,25 +62,25 @@ For further information about ecosystem support for {% data variables.product.pr
{% ifversion dependabot-bun-support %}
-#### Bun
+### Bun
{% data variables.product.prodname_dependabot %} supports the current default text-based `bun.lock` file, but not the legacy binary `bun.lockb` file. The `bun.lock` file is supported in version 1.1.39 and above. For more information, see [Lockfile](https://bun.sh/docs/install/lockfile) in the Bun documentation.
{% endif %}
-#### Cargo
+### Cargo
Private registry support includes cargo registries, so you can use {% data variables.product.prodname_dependabot %} to keep your Rust dependencies up-to-date. For more information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot#cargo).
{% ifversion dependabot-conda-support %}
-#### Conda
+### Conda
{% data variables.product.prodname_dependabot %} support for Conda does **not include private registries, vendoring, or lock file updates**.
{% endif %}
-#### Dev containers
+### Dev containers
You can use `devcontainers` as a `package-ecosystem` in your `dependabot.yml` file to update Features in your `devcontainer.json` configuration files. For more information about this support, and for configuration file examples, see [General Availability of {% data variables.product.prodname_dependabot %} Integration](https://containers.dev/guide/dependabot) in the Development Containers documentation.
@@ -81,7 +90,7 @@ This updater ensures Features are pinned to the latest `major` version in the as
Features in any valid dev container location will be updated in a single pull request. For more information about the dev container specification, see [Specification](https://containers.dev/implementors/spec/#devcontainerjson) in the Development Containers documentation.
-#### Docker
+### Docker
{% data variables.product.prodname_dependabot %} can add metadata from Docker images to pull requests for version updates. The metadata includes release notes, changelogs and the commit history. Repository administrators can use the metadata to quickly evaluate the stability risk of the dependency update.
@@ -95,13 +104,13 @@ In order for {% data variables.product.prodname_dependabot %} to fetch Docker me
{% ifversion dependabot-docker-compose-support %}
-#### Docker Compose
+### Docker Compose
{% data variables.product.prodname_dependabot %} supports Docker Compose in a similar way to Docker. For more information, see [Docker](#docker).
{% endif %}
-#### {% data variables.product.prodname_actions %}
+### {% data variables.product.prodname_actions %}
{% data variables.product.prodname_dependabot %} supports version updates for {% data variables.product.prodname_actions %} with the following caveats.
@@ -109,11 +118,13 @@ In order for {% data variables.product.prodname_dependabot %} to fetch Docker me
For more information about using {% data variables.product.prodname_dependabot_version_updates %} with {% data variables.product.prodname_actions %}, see [AUTOTITLE](/actions/security-guides/using-githubs-security-features-to-secure-your-use-of-github-actions#keeping-the-actions-in-your-workflows-secure-and-up-to-date).
-#### Gradle
+### Gradle
{% data variables.product.prodname_dependabot %} doesn't run Gradle but supports updates to the following files:
* `build.gradle`, `build.gradle.kts` (for Kotlin projects)
* `gradle/libs.versions.toml` (for projects using a standard Gradle version catalog)
+* `gradle.lockfile` (for projects using Gradle dependency locking)
+* `gradle/wrapper/gradle-wrapper.properties` (for the Gradle Wrapper)
* Files included via the `apply` declaration that have `dependencies` in the filename. Note that `apply` does not support `apply to`, recursion, or advanced syntaxes (for example, Kotlin's `apply` with `mapOf`, filenames defined by property).
{% data variables.product.prodname_dependabot %} uses information from the `pom.xml` file of dependencies to add links to release information in update pull requests. If the information is omitted from the `pom.xml` file, then it cannot be included in {% data variables.product.prodname_dependabot %} pull requests, see [AUTOTITLE](/code-security/dependabot/ecosystems-supported-by-dependabot/optimizing-java-packages-dependabot).
@@ -124,25 +135,25 @@ For {% data variables.product.prodname_dependabot_security_updates %}, Gradle su
> * When you upload Gradle dependencies to the dependency graph using the {% data variables.dependency-submission-api.name %}, all project dependencies are uploaded, even transitive dependencies that aren't explicitly mentioned in any dependency file. When an alert is detected in a transitive dependency, {% data variables.product.prodname_dependabot %} isn't able to find the vulnerable dependency in the repository, and therefore won't create a security update for that alert.
> * {% data variables.product.prodname_dependabot_version_updates %} will, however, create pull requests when the parent dependency is explicitly declared as a direct dependency in the project's manifest file.
-#### Helm Charts
+### Helm Charts
{% data variables.product.prodname_dependabot %} supports using a username and password for registries. For more information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#helm-registry).
-{% data variables.product.prodname_dependabot %} works with any OCI-compliant registries that implement the Open Container Initiative (OCI) Distribution Specification.
+The `helm-registry` type only supports HTTP Basic Auth and does not support OCI-compliant registries. If you need to access an OCI-compliant registry for Helm charts, configure a `docker-registry` instead. For more information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#docker-registry).
-When configuring Dependabot for Helm charts, it will also automatically update the Docker images referenced within those charts, ensuring that both the chart versions and their contained images stay up to date.
+When configuring {% data variables.product.prodname_dependabot %} for Helm charts, it will also automatically update the Docker images referenced within those charts, ensuring that both the chart versions and their contained images stay up to date.
-#### Maven
+### Maven
{% data variables.product.prodname_dependabot %} doesn't run Maven but supports updates to `pom.xml` files.
{% data variables.product.prodname_dependabot %} uses information from the `pom.xml` file of dependencies to add links to release information in update pull requests. If the information is omitted from the `pom.xml` file, then it cannot be included in {% data variables.product.prodname_dependabot %} pull requests, see [AUTOTITLE](/code-security/dependabot/ecosystems-supported-by-dependabot/optimizing-java-packages-dependabot).
-#### NuGet CLI
+### NuGet CLI
{% data variables.product.prodname_dependabot %} doesn't run the NuGet CLI but does support most features up until version 6.8.0.
-#### pip and pip-compile
+### pip and pip-compile
{% data variables.product.prodname_dependabot %} supports updates to any `.txt` file.
@@ -152,24 +163,18 @@ In addition, {% data variables.product.prodname_dependabot %} supports updates t
{% else %}
-#### pnpm
+### pnpm
pnpm is supported for {% data variables.product.prodname_dependabot_version_updates %} (on v7, v8, v9, v10) and {% data variables.product.prodname_dependabot_security_updates %} (on v7 and v8 only).
{% endif %}
-#### poetry
+### poetry
The PEP 621 `project` section isn't currently supported for `poetry`.
-#### pub
-
-{% data variables.product.prodname_dependabot %} won't perform an update for `pub` when the version that it tries to update to is ignored, even if an earlier version is available.
-
-You can use {% data variables.product.prodname_dependabot %} to keep Dart dependencies up-to-date if you use private hosted pub repositories. For information about allowing {% data variables.product.prodname_dependabot %} to access private {% data variables.product.prodname_dotcom %} dependencies, see [Allowing {% data variables.product.prodname_dependabot %} to access private dependencies](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-dependabot-to-access-private{% ifversion ghec or ghes %}-or-internal{% endif %}-dependencies).
-
{% ifversion dependabot-rust-toolchain-support %}
-#### Rust toolchain
+### Rust toolchain
{% data variables.product.prodname_dependabot %} supports automatic updates for Rust toolchain versions defined in `rust-toolchain.toml` and `rust-toolchain` files.
@@ -180,11 +185,11 @@ Supported update patterns {% data variables.product.prodname_dependabot %} can u
{% endif %}
-#### Swift
+### Swift
Private registry support applies to git registries only. Swift registries are not supported. Non-declarative manifests are not supported. For more information on non-declarative manifests, see [Editing Non-Declarative Manifests](https://github.com/apple/swift-evolution/blob/7003da1439ad60896ec14657dfce829f04b0632c/proposals/0301-package-editing-commands.md#editing-non-declarative-manifests) in the Swift Evolution documentation.
-#### Terraform
+### Terraform
Terraform support includes:
* Modules hosted on Terraform Registry or a publicly reachable Git repository.
@@ -193,12 +198,46 @@ Terraform support includes:
{% ifversion dependabot-vcpkg-support %}
-#### vcpkg
+### vcpkg
vcpkg support includes updating the `builtin-baseline` commit SHA from the vcpkg ports repository in your `vcpkg.json` manifest file. For more information visit the [`microsoft/vcpkg` repository](https://github.com/microsoft/vcpkg) on {% data variables.product.prodname_dotcom_the_website %} and see [What is manifest mode?](https://learn.microsoft.com/vcpkg/concepts/manifest-mode) in the Microsoft documentation.
{% endif %}
-#### yarn
+### yarn
Dependabot supports vendored dependencies for v2 onwards.
+
+{% ifversion dependabot-community-ecosystems %}
+
+## Supported community-maintained ecosystems
+
+{% data reusables.dependabot.community-maintained-intro %} {% ifversion dependabot-julia-support %}
+
+* [Julia](#julia) - Maintained by the Julia community{% endif %}{% ifversion dependabot-julia-support %}
+* [OpenTofu](#opentofu) - Maintained by the OpenTofu community{% endif %}
+* [Pub](#pub) - Maintained by The Dart Community
+
+{% ifversion dependabot-julia-support %}
+
+### Julia
+
+{% data variables.product.prodname_dependabot %} supports Julia projects that include `Project.toml`/`Manifest.toml` files. {% data variables.product.prodname_dependabot %} uses Julia's package manager to resolve and update dependencies.
+
+{% endif %}
+
+{% ifversion dependabot-opentofu-support %}
+
+### OpenTofu
+
+{% data variables.product.prodname_dependabot %} supports updating OpenTofu modules and providers in `.tf` and `.tofu` configuration files, including `terragrunt.hcl` files. If the `.terraform.lock.hcl` lockfile for provider checksums is present, {% data variables.product.prodname_dependabot %} will also update it.
+
+{% endif %}
+
+{% endif %}
+
+### Pub
+
+{% data variables.product.prodname_dependabot %} won't perform an update for `pub` when the version that it tries to update to is ignored, even if an earlier version is available.
+
+You can use {% data variables.product.prodname_dependabot %} to keep Dart dependencies up-to-date if you use private hosted pub repositories. For information about allowing {% data variables.product.prodname_dependabot %} to access private {% data variables.product.prodname_dotcom %} dependencies, see [Allowing {% data variables.product.prodname_dependabot %} to access private dependencies](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-dependabot-to-access-private{% ifversion ghec or ghes %}-or-internal{% endif %}-dependencies).
diff --git a/data/reusables/dependabot/version-updates-skip-scheduled-runs.md b/data/reusables/dependabot/version-updates-skip-scheduled-runs.md
deleted file mode 100644
index 4b350eaf0c3b..000000000000
--- a/data/reusables/dependabot/version-updates-skip-scheduled-runs.md
+++ /dev/null
@@ -1 +0,0 @@
-Sometimes, due to a misconfiguration or an incompatible version, you might see that a {% data variables.product.prodname_dependabot %} run has failed. After 15 failed runs, {% data variables.product.prodname_dependabot_version_updates %} will skip subsequent scheduled runs until you manually trigger a check for updates from the dependency graph. {% data variables.product.prodname_dependabot_security_updates %} will still run as usual.
diff --git a/data/reusables/dependabot/vnet-arc-note.md b/data/reusables/dependabot/vnet-arc-note.md
index d08e19885220..7442b271204c 100644
--- a/data/reusables/dependabot/vnet-arc-note.md
+++ b/data/reusables/dependabot/vnet-arc-note.md
@@ -1,7 +1,7 @@
{% ifversion dependabot-vnet-support or dependabot-arc-support %}
>[!NOTE]
-> Private networking is supported with either an Azure Virtual Network (VNET) or the Actions Runner Controller (ARC) for {% data variables.product.prodname_dependabot %} on {% data variables.product.prodname_actions %}. See [AUTOTITLE](/code-security/dependabot/working-with-dependabot/setting-dependabot-to-run-on-self-hosted-runners-using-arc) and [AUTOTITLE](/code-security/dependabot/working-with-dependabot/setting-dependabot-to-run-on-github-hosted-runners-using-vnet) for more information, and instruction.
+> Private networking is supported with either an Azure Virtual Network (VNET) or the Actions Runner Controller (ARC) for {% data variables.product.prodname_dependabot %} on {% data variables.product.prodname_actions %}. See [AUTOTITLE](/code-security/dependabot/working-with-dependabot/setting-dependabot-to-run-on-self-hosted-runners-using-arc) and [AUTOTITLE](/code-security/dependabot/working-with-dependabot/setting-dependabot-to-run-on-github-hosted-runners-using-vnet).
{% else %}
diff --git a/data/reusables/dependency-graph/supported-package-ecosystems.md b/data/reusables/dependency-graph/supported-package-ecosystems.md
index 419e8b374c0c..faba07342cea 100644
--- a/data/reusables/dependency-graph/supported-package-ecosystems.md
+++ b/data/reusables/dependency-graph/supported-package-ecosystems.md
@@ -1,13 +1,22 @@
| Package manager | Languages | Static transitive dependencies | Automatic dependency submission | Recommended files | Additional files |
| --- | --- | --- | --- | --- | ---|
+| {% ifversion dependabot-bazel-support %} |
+| Bazel | Starlark | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | `MODULE.bazel`, `WORKSPACE` | `MODULE.bazel.lock`, `maven_install.json`, `*.MODULE.bazel` |
+| {% endif %} |
| Cargo | Rust | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | `Cargo.lock` | `Cargo.toml` |
| Composer | PHP | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | `composer.lock` | `composer.json` |
| NuGet | .NET languages (C#, F#, VB), C++ | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | `.csproj`, `.vbproj`, `.nuspec`, `.vcxproj`, `.fsproj` | `packages.config` |
| {% data variables.product.prodname_actions %} workflows | YAML | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | `.yml`, `.yaml` | {% octicon "x" aria-label="None" %} |
| Go modules | Go | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | `go.mod`| {% octicon "x" aria-label="None" %} |
| Gradle | Java | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="None" %} | {% octicon "x" aria-label="None" %} |
+| {% ifversion dependabot-julia-support %} |
+| Julia | Julia | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | `Manifest.toml` | `Project.toml` |
+| {% endif %} |
| Maven | Java, Scala | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | `pom.xml` | {% octicon "x" aria-label="None" %} |
| npm | JavaScript | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | `package-lock.json` | `package.json`|
+| {% ifversion dependabot-opentofu-support %} |
+| OpenTofu | HCL | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | `.terraform.lock.hcl` | `.tf`, `.tofu` |
+| {% endif %} |
| pip | Python | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | `requirements.txt`, `pipfile.lock` | `pipfile`, `setup.py` |
| pnpm | JavaScript | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | `pnpm-lock.yaml` | `package.json` |
| pub | Dart | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | `pubspec.lock` | `pubspec.yaml` |
@@ -17,7 +26,26 @@
| Yarn | JavaScript | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | `yarn.lock` | `package.json` |
> [!NOTE]{% ifversion transitive-dependency-labeling-npm %}
+>
> * The **Static transitive dependencies** column indicates whether static analysis will add `direct` and `transitive` labels for dependent packages in that ecosystem. Dependency submission actions (automatic or manually configured) can add transitive information for ecosystems where static analysis cannot. {% endif %}
> * If you list your Python dependencies within a `setup.py` file, we may not be able to parse and list every dependency in your project.
> * {% data variables.product.prodname_actions %} workflows must be located in the `.github/workflows/` directory of a repository to be recognized as manifests. Any actions or workflows referenced using the syntax `jobs[*].steps[*].uses` or `jobs..uses` will be parsed as dependencies. For more information, see [AUTOTITLE](/actions/using-workflows/workflow-syntax-for-github-actions).
> * {% data reusables.dependabot.dependabot-alert-actions-semver %} For more information, see [AUTOTITLE](/code-security/dependabot/dependabot-alerts/about-dependabot-alerts) and [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates).
+
+{% ifversion dependabot-community-ecosystems %}
+
+### Community-maintained ecosystems
+
+{% data reusables.dependabot.community-maintained-intro %}
+
+| Ecosystem | Maintained by |
+| --- | --- |
+| {% ifversion dependabot-julia-support %} |
+| Julia | Julia community |
+| {% endif %} |
+| {% ifversion dependabot-opentofu-support %} |
+| OpenTofu | OpenTofu community |
+| {% endif %} |
+| pub | Dart community |
+
+{% endif %}
diff --git a/data/reusables/dependency-graph/used-by.md b/data/reusables/dependency-graph/used-by.md
new file mode 100644
index 000000000000..6d8f01c31d58
--- /dev/null
+++ b/data/reusables/dependency-graph/used-by.md
@@ -0,0 +1 @@
+Some repositories have a "Used by" section in the sidebar of the **Code** tab. This section shows the number of public references to a package that were found, and displays the avatars of some of the owners of the dependent projects.
diff --git a/data/reusables/dependency-submission/dependency-submission-link.md b/data/reusables/dependency-submission/dependency-submission-link.md
index 73d50d1f628d..0ec804e1b8f0 100644
--- a/data/reusables/dependency-submission/dependency-submission-link.md
+++ b/data/reusables/dependency-submission/dependency-submission-link.md
@@ -1,2 +1,2 @@
-Additionally, you can use the {% data variables.dependency-submission-api.name %} to submit dependencies from the package manager or ecosystem of your choice, even if the ecosystem is not supported by dependency graph for manifest or lock file analysis.
+You can use the {% data variables.dependency-submission-api.name %} to submit dependencies from the package manager or ecosystem of your choice, even if the ecosystem is not supported by dependency graph for manifest or lock file analysis.
Dependencies submitted to a project using the {% data variables.dependency-submission-api.name %} will show which detector was used for their submission and when they were submitted. For more information on the {% data variables.dependency-submission-api.name %}, see [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api).
diff --git a/data/reusables/enterprise-accounts/enterprise-apps-capabilities.md b/data/reusables/enterprise-accounts/enterprise-apps-capabilities.md
new file mode 100644
index 000000000000..088a2d6c6bbc
--- /dev/null
+++ b/data/reusables/enterprise-accounts/enterprise-apps-capabilities.md
@@ -0,0 +1,9 @@
+Enterprise-installed {% data variables.product.prodname_github_apps %} cannot call every enterprise API, but several APIs have already been updated to support {% data variables.product.prodname_github_apps %}. These APIs and GraphQL mutations include:
+
+* [List and create organizations in your enterprise](/graphql/reference/mutations#createenterpriseorganization)
+* [Manage users in your enterprise](/graphql/reference/objects#enterprise)
+* Create and manage {% data variables.product.prodname_github_app %} installations in your organizations
+* Manage enterprise custom repository properties
+* Call the enterprise SCIM APIs
+
+Check the [changelog](https://github.blog/changelog/) for updates on new APIs and permissions for {% data variables.product.prodname_github_apps %}.
diff --git a/data/reusables/enterprise-accounts/github-apps-tab.md b/data/reusables/enterprise-accounts/github-apps-tab.md
index 59f8acf85498..8ce0f568119f 100644
--- a/data/reusables/enterprise-accounts/github-apps-tab.md
+++ b/data/reusables/enterprise-accounts/github-apps-tab.md
@@ -1 +1 @@
-1. In the left sidebar, click **{% octicon "apps" aria-hidden="true" %} GitHub Apps**.
+1. In the left sidebar, click **{% octicon "apps" aria-hidden="true" %} {% data variables.product.prodname_github_apps %}**.
diff --git a/data/reusables/enterprise-accounts/payment-information-tab-both-platforms.md b/data/reusables/enterprise-accounts/payment-information-tab-both-platforms.md
deleted file mode 100644
index 07a27a91dd3e..000000000000
--- a/data/reusables/enterprise-accounts/payment-information-tab-both-platforms.md
+++ /dev/null
@@ -1 +0,0 @@
-1. Under "Billing & Licensing", click **Payment information**.
diff --git a/data/reusables/enterprise-migration-tool/data-not-migrated.md b/data/reusables/enterprise-migration-tool/data-not-migrated.md
index 79cc2db94f0a..cf4a963da2da 100644
--- a/data/reusables/enterprise-migration-tool/data-not-migrated.md
+++ b/data/reusables/enterprise-migration-tool/data-not-migrated.md
@@ -1,5 +1,6 @@
* Audit logs
* {% data variables.product.prodname_code_scanning_caps %} results
+* {% data variables.product.prodname_codespaces %} secrets
* Commit status checks
* {% data variables.product.prodname_dependabot %} alerts
* {% data variables.product.prodname_dependabot %} secrets
@@ -21,6 +22,8 @@
* Repository stars
* Repository watchers
* Rulesets
+* Sub-issues (see [AUTOTITLE](/issues/tracking-your-work-with-issues/learning-about-issues/about-issues#about-sub-issues))
* Tag protection rules
+* User access to the repository
* Users' profiles, SSH keys, signing keys, or {% data variables.product.pat_generic_plural %}
* Webhook secrets
diff --git a/data/reusables/enterprise-migration-tool/deploy-key-bypass.md b/data/reusables/enterprise-migration-tool/deploy-key-bypass.md
deleted file mode 100644
index 6d7e8d5b20f8..000000000000
--- a/data/reusables/enterprise-migration-tool/deploy-key-bypass.md
+++ /dev/null
@@ -1,3 +0,0 @@
-> [!NOTE] If the repository you are migrating has rulesets that the incoming repository doesn't match, the migration will be blocked. To bypass these rulesets and allow the migration, you can apply a ruleset bypass for all deploy keys in the target organization.
->
-> Repository rulesets can be set at the organization level. If the incoming repository does not match any of these rulesets, you will need to use the deploy key bypass for each one. See [AUTOTITLE](/organizations/managing-organization-settings/creating-rulesets-for-repositories-in-your-organization#granting-bypass-permissions-for-your-branch-or-tag-ruleset).
diff --git a/data/reusables/enterprise-migration-tool/repository-migrations-bypass.md b/data/reusables/enterprise-migration-tool/repository-migrations-bypass.md
new file mode 100644
index 000000000000..396da2dc8647
--- /dev/null
+++ b/data/reusables/enterprise-migration-tool/repository-migrations-bypass.md
@@ -0,0 +1,9 @@
+If the destination organization or enterprise of your migration has rulesets enabled, the migrated repository's history may violate those rules. To allow the migration without disabling your rulesets, add "Repository migrations" to the bypass list for each applicable ruleset. This bypass applies only during the migration. Once complete, rulesets will be enforced on all new contributions.
+
+To configure the bypass:
+
+1. Navigate to each enterprise or organization ruleset.
+1. In the "Bypass list" section, click **Add bypass**.
+1. Select **Repository migrations**.
+
+For more information, see [AUTOTITLE](/organizations/managing-organization-settings/creating-rulesets-for-repositories-in-your-organization#granting-bypass-permissions-for-your-branch-or-tag-ruleset).
diff --git a/data/reusables/enterprise-onboarding/automations.md b/data/reusables/enterprise-onboarding/automations.md
new file mode 100644
index 000000000000..e7d8b700fdc4
--- /dev/null
+++ b/data/reusables/enterprise-onboarding/automations.md
@@ -0,0 +1,119 @@
+Automation on {% data variables.product.github %} typically involves multiple components working together. The most important {% data variables.product.github %} native components are:
+
+* **{% data variables.product.prodname_actions %} workflows**, which provide a runtime for executing automation logic. Out of the box, they work within a single repository, but they can be extended to automate across or even outside of repositories.
+* **{% data variables.product.prodname_github_apps %}**, which do not have a runtime. Instead, they provide identity, permissions, and event delivery so your automations, whether external services or workflows, can authenticate and act securely.
+
+Most enterprise automation use {% data variables.product.prodname_github_apps %} and {% data variables.product.prodname_actions %} together. For example, a workflow running in {% data variables.product.prodname_actions %} may use a {% data variables.product.prodname_github_app %} to obtain a short-lived token that allows it to perform tasks across repositories or organizations.
+
+This guide explains how {% data variables.product.prodname_github_apps %}, external automations, and {% data variables.product.prodname_actions %} complement each other, and when to use each in your enterprise.
+
+## {% data variables.product.prodname_github_apps %}
+
+A {% data variables.product.prodname_github_app %} provides the **identity, permissions, and webhook events** required for automation on or across repositories, organizations, or your enterprise. {% data variables.product.prodname_github_apps %} themselves do **not** execute logic, they enable other systems to do so.
+
+{% data variables.product.prodname_github_apps %} support enterprise automation by offering:
+
+* **Granular permissions** to follow least-privilege principles
+* **Scoped installations** at the enterprise, organization, or repository level
+* **Short-lived tokens** for secure access
+* **Distinct identities** with full auditability
+* **Delegated administration** through the {% data variables.product.prodname_github_app %} manager role
+* **Consistency at scale** when owned by the enterprise account
+
+### What do {% data variables.product.prodname_github_apps %} enable?
+
+{% data variables.product.prodname_github_apps %} allow **automations you write elsewhere**āsuch as external services or workflow stepsāto act on {% data variables.product.github %} APIs within the permissions you grant. For example:
+
+* Receiving webhook events and triggering external services
+* Enabling a workflow to act outside its default repository scope
+* Integrating {% data variables.product.github %} with third-party systems
+* Coordinating changes across many repositories
+* Running long-lived bots or services that monitor enterprise-level activity
+
+{% ifversion enterprise-installed-apps %}
+
+> [!NOTE]
+> Enterprise-installed {% data variables.product.prodname_github_apps %} cannot call every API endpoint. See [AUTOTITLE](/apps/using-github-apps/installing-a-github-app-on-your-enterprise#what-enterprise-installed-apps-can-do).
+
+{% endif %}
+
+## {% data variables.product.prodname_actions %}
+
+{% data variables.product.prodname_actions %} provide {% data variables.product.github %}ās built-in **runtime** for executing automation logic inside repositories. Workflows run on hosted or self-hosted runners and are ideal for tasks tied to code changes or repository events.
+
+Use {% data variables.product.prodname_actions %} for:
+
+* CI/CD (build, test, deploy)
+* Pull request checks and validations
+* Repository-level maintenance tasks
+* Event-driven workflows responding to pushes, tags, or issue updates
+* Scheduled jobs with cron
+
+### How {% data variables.product.prodname_actions %} uses {% data variables.product.prodname_github_apps %}
+
+{% data variables.product.prodname_actions %} and {% data variables.product.prodname_github_apps %} are deeply connected:
+
+* Workflow permissions map directly to {% data variables.product.prodname_github_app %} permissions.
+* Workflows can authenticate as a specific {% data variables.product.prodname_github_app %} using `actions/create-github-app-token`.
+* {% data variables.product.prodname_github_apps %} can trigger workflows through events such as `repository_dispatch`.
+
+## External automations and services
+
+External automations run outside {% data variables.product.github %} on your own infrastructure. These services typically:
+
+* Receive webhook events from a {% data variables.product.prodname_github_app %}
+* Use the {% data variables.product.prodname_github_app %} to request short-lived installation tokens
+* Execute long-running or cross-enterprise logic
+* Integrate with external business systems
+
+Examples include:
+
+* Organization-wide configuration management
+* Policy enforcement services
+* Multi-repository code or metadata synchronization
+* Compliance report generation
+* Cross-organization issue or pull request management
+
+All of these rely on {% data variables.product.prodname_github_apps %} for authentication, identity, and eventsā**not** for execution.
+
+## How these components work together
+
+Most enterprise automation uses a combination of {% data variables.product.prodname_github_apps %}, external services, and {% data variables.product.prodname_actions %} to achieve robust, scalable workflows.
+
+For example:
+
+1. An enterprise {% data variables.product.prodname_github_app %} receives a webhook when a new repository is created, and sends the webhook payload to a server where an external service is running.
+1. The external service standardizes required settings and provisions resources.
+1. The service triggers a {% data variables.product.prodname_actions %} workflow in the repository.
+1. The workflow performs CI, deploys templates, or configures scanning.
+
+Each component handles a different layer of automation.
+
+## When to use each type of automation
+
+Use **a {% data variables.product.prodname_github_app %}** when you need:
+
+* Authentication or permission to act across many repositories
+* Integration with external systems
+* Webhook-driven automations
+* Long-lived or enterprise-wide workflows
+* Auditability and identity separation
+
+Use **external automations** when you need:
+
+* Logic that runs continuously or outside {% data variables.product.github %}
+* Integration with internal systems
+
+Use **{% data variables.product.prodname_actions %}** when you need:
+
+* CI/CD pipelines
+* Repository-scoped automation
+* Automated checks tied to repository events
+* Execution of logic using {% data variables.product.github %}ās runner infrastructure
+
+Use **{% data variables.product.prodname_github_apps %} and {% data variables.product.prodname_actions %} together** when:
+
+* A workflow must act beyond the repositoryās default permissions
+* A {% data variables.product.prodname_github_app %} needs to trigger a workflow
+* External logic orchestrates in-repo execution
+* Enterprise-wide policies or workflows require both identity and runtime
diff --git a/data/reusables/enterprise-onboarding/create-enterprise-teams.md b/data/reusables/enterprise-onboarding/create-enterprise-teams.md
index f11d9c492dc9..4bcedd66806c 100644
--- a/data/reusables/enterprise-onboarding/create-enterprise-teams.md
+++ b/data/reusables/enterprise-onboarding/create-enterprise-teams.md
@@ -48,10 +48,10 @@ If you use {% data variables.product.prodname_emus %}, you can sync membership o
#### Limits on IdP group sizes
-If an IdP group goes over the team size limit of 500 users, the team will stop being synced.
+If an IdP group goes over the team size limit of 5,000 users, the team will stop being synced.
For example:
* An enterprise team is initially synced with an IdP group of 5 users.
-* 500 more users are added to the IdP group. Because the IdP group now has 505 users, the group isn't synced and the enterprise team remains at 5 members.
-* 5 users are removed from the IdP group to bring it to 500 users. Syncing resumes and the enterprise team now contains the same 500 users as the IdP group.
+* 5,000 more users are added to the IdP group. Because the IdP group now has 5,005 users, the group isn't synced and the enterprise team remains at 5 members.
+* 5 users are removed from the IdP group to bring it to 5,000 users. Syncing resumes and the enterprise team now contains the same 5,000 users as the IdP group.
diff --git a/data/reusables/enterprise-onboarding/creating-custom-properties.md b/data/reusables/enterprise-onboarding/creating-custom-properties.md
index 64db02761a57..11a4856beeb6 100644
--- a/data/reusables/enterprise-onboarding/creating-custom-properties.md
+++ b/data/reusables/enterprise-onboarding/creating-custom-properties.md
@@ -25,7 +25,7 @@ You can add custom properties to your enterprise to make those properties availa
{% data reusables.enterprise-accounts.access-enterprise %}
1. In the left sidebar, under "Policies", click **Custom properties**.
1. To add a new custom property, in the upper-right corner, click **New property**.
-1. Enter a name, description, and type for the custom property. The name must be unique across all of your organizations, and cannot contain spaces.
+1. Enter a name, description, and type for the custom property. The name must be unique across all of your organizations, can't contain spaces, and cannot exceed 75 characters in length.
1. Optionally, select **Allow repository actors to set this property**. When enabled, repository users and apps with the repository-level `custom properties` fine-grained permission will be able to set and update the property value for their repository. Additionally, any actor creating a repository can set the property on the repository.
1. Optionally, select **Require this property for all repositories** and add a default value. This means that you require that all repositories in your enterprise have a value for this property. Repositories that donāt have an explicit value for this property will inherit the default value.
1. Click **Save property**.
diff --git a/data/reusables/enterprise-onboarding/identify-role-requirements.md b/data/reusables/enterprise-onboarding/identify-role-requirements.md
index c2ff768987a9..9ba991d0150f 100644
--- a/data/reusables/enterprise-onboarding/identify-role-requirements.md
+++ b/data/reusables/enterprise-onboarding/identify-role-requirements.md
@@ -59,3 +59,9 @@ Not all tasks are best-suited to humans. Identify frequent, time-consuming, and
* They have their own identity, which you can trace in audit logs.
For more information about what apps can do, see [AUTOTITLE](/apps/creating-github-apps/about-creating-github-apps/about-creating-github-apps#understanding-what-type-of-github-app-to-build).
+
+## 6. Assign tasks to agents
+
+Another way to delegate frequent, time-consuming tasks is to assign work to {% data variables.copilot.copilot_coding_agent %}. You can define custom agents for specific roles in your enterprise. Custom agents are created using Markdown files called "agent profiles," which define the instructions and tools the agent needs to perform a task. For example, you could create a custom agent for writing README files or generating unit tests.
+
+For more information, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/prepare-for-custom-agents).
diff --git a/data/reusables/enterprise-onboarding/use-innersource.md b/data/reusables/enterprise-onboarding/use-innersource.md
new file mode 100644
index 000000000000..51ef77ecbcc5
--- /dev/null
+++ b/data/reusables/enterprise-onboarding/use-innersource.md
@@ -0,0 +1,52 @@
+You can use innersource practices to drive collaboration and productivity in your enterprise. Innersource makes it easy for all employees to discover and reuse work. This allows development teams to learn from each other's work, share their expertise, and avoid duplicating effort to recreate common services.
+
+## Make repositories discoverable
+
+Unless they contain sensitive information, you should aim to make repositories visible to all employees.
+
+To do this, encourage employees to use **internal** visibility whenever possible. Internal visibility allows any member of any organization in the enterprise to view the repository, regardless of whether the user is a member of the organization that owns the repository.
+
+You should also set permissive **base permissions** for organizations. An organization's base permission policy determines the default level of access that members of that organization have to all the organization's repositories. Generally, organizations should have at least a "Read" base permission so that all organization members can see any repository. Organization owners can then use teams to grant people greater levels of access in specific repositories.
+
+If you have more sensitive repositories that should not be widely visible, you can set up a dedicated organization with a more restrictive base permission and add specific teams to this organization.
+
+For more information, see [AUTOTITLE](/repositories/creating-and-managing-repositories/about-repositories#about-internal-repositories) and [AUTOTITLE](/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/setting-base-permissions-for-an-organization).
+
+## Document projects
+
+Organize and document your repositories so that people can search for work across the enterprise.
+
+Repository **READMEs** are effective because they're defined in files in the repository, so users can search for them like code. You can also create READMEs at the level of an organization or enterprise account to provide a higher-level overview of where to find different projects. For more formal internal documentation, consider setting up a **{% data variables.product.prodname_pages %} site** or **wikis**.
+
+You can use **repository topics** to group repositories that contain a certain programming language, are owned by a certain team, and so on. This is another way of making repositories easier to find.
+
+For more information, see:
+
+* [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-readmes), [AUTOTITLE](/organizations/collaborating-with-groups-in-organizations/customizing-your-organizations-profile#adding-a-member-only-organization-profile-readme), and [AUTOTITLE](/admin/managing-your-enterprise-account/creating-a-readme-for-an-enterprise)
+* [AUTOTITLE](/pages/getting-started-with-github-pages/creating-a-github-pages-site)
+* [AUTOTITLE](/communities/documenting-your-project-with-wikis/adding-or-editing-wiki-pages)
+* [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics)
+
+## Set up a culture for sharing work
+
+Encourage teams to publicize their work and share resources with other teams. {% data variables.product.github %} has a number of features that make this easier. For example, teams can:
+
+* Use **discussions** to make their work more visible to other teams. See [AUTOTITLE](/discussions/collaborating-with-your-community-using-discussions/participating-in-a-discussion#creating-a-discussion).
+* Create a dedicated internal repository for sharing **actions and reusable {% data variables.product.prodname_actions %} workflows**, which anyone can reference when they write a workflow within the enterprise. See [AUTOTITLE](/actions/how-tos/reuse-automations/share-with-your-enterprise).
+* Share reusable pieces of code in internal packages with **{% data variables.product.prodname_registry %}** registries. For enhanced security, you can give {% data variables.product.github %}'s security features access to these registries. See [AUTOTITLE](/packages/learn-github-packages/introduction-to-github-packages).
+* Set up common templates and frameworks as **template repositories** that other people can copy to get started with a project. See [AUTOTITLE](/repositories/creating-and-managing-repositories/creating-a-template-repository).
+
+Like with an open source project, you should ensure shared projects have a support model and a clearly defined team of maintainers, especially for services that many parts of your enterprise rely on. Ideally the maintainers team will contain representatives from the different teams that use the service.
+
+## Hide content from external collaborators
+
+If you have external contractors or collaborators who need access to your enterprise's projects, you can grant them a different level of access from regular employees.
+
+Specifically, you may want to hide internal repositories from an external collaborator. To do this:
+
+* If you use {% data variables.product.prodname_emus %}, provision an account for the user with the **guest collaborator** role. Guest collaborators don't have access to internal repositories by default, but they receive base permissions in organizations where they're added as members. They can also be added as repository collaborators in repositories.
+* If you do not use {% data variables.product.prodname_emus %}, add the user as an **outside collaborator** in the required repositories, but ensure they are not added as a member of any organization.
+
+Outside collaborators (called **repository collaborators** if you use {% data variables.product.prodname_emus %}) only have access to a specific repository. These users are not full organization members, so they do not receive the base level of access for the organization, and they cannot automatically see internal repositories in the enterprise unless they are a member of another organization.
+
+For more information, see {% ifversion ghec %}[AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/enabling-guest-collaborators) and{% endif %} [AUTOTITLE](/organizations/managing-user-access-to-your-organizations-repositories/managing-outside-collaborators/adding-outside-collaborators-to-repositories-in-your-organization).
diff --git a/data/reusables/enterprise/enterprise-teams-limits.md b/data/reusables/enterprise/enterprise-teams-limits.md
index 666a1aa0f7f9..6ad030e812b0 100644
--- a/data/reusables/enterprise/enterprise-teams-limits.md
+++ b/data/reusables/enterprise/enterprise-teams-limits.md
@@ -1 +1 @@
-There are **limits on enterprise teams**. You can create up to 100 teams for a single enterprise and add up to 500 users to each team. Each team can be assigned to a maximum of 1,000 organizations.
+There are **limits on enterprise teams**. You can create up to 2,500 teams for a single enterprise and add up to 5,000 users to each team. Each team can be assigned to a maximum of 1,000 organizations.
diff --git a/data/reusables/enterprise_installation/replication-command.md b/data/reusables/enterprise_installation/replication-command.md
index ef876aa65290..853d84ffaa25 100644
--- a/data/reusables/enterprise_installation/replication-command.md
+++ b/data/reusables/enterprise_installation/replication-command.md
@@ -6,3 +6,4 @@
> [!WARNING]
> `ghe-repl-start` causes a brief outage on the primary server, during which users may see internal server errors. To provide a friendlier message, run `ghe-maintenance -s` on the primary node before running `ghe-repl-start` on the replica node to put the appliance in maintenance mode. Once replication starts, disable maintenance mode with `ghe-maintenance -u`. Git replication will not progress while the primary node is in maintenance mode.
+ > If you are running version 3.14.20, 3.15.15, 3.16.11, 3.17.8, 3.18.2, or a later version including future releases like 3.19, you no longer need to put the primary in maintenance mode prior to running `ghe-repl-start`. This command is no longer expected to cause an outage on the primary server. However, when setting up a new replica, `ghe-repl-start` won't cause an outage as long as you run `ghe-config-apply` between `ghe-repl-setup` and `ghe-repl-start`. Skipping `ghe-config-apply` and going straight from `ghe-repl-setup` to `ghe-repl-start` will still result in an outage.
diff --git a/data/reusables/gated-features/code-scanning.md b/data/reusables/gated-features/code-scanning.md
index bb8c3a6b846a..ea4644d585a5 100644
--- a/data/reusables/gated-features/code-scanning.md
+++ b/data/reusables/gated-features/code-scanning.md
@@ -1,14 +1,4 @@
{% data variables.product.prodname_code_scanning_caps %} is available for the following repository types:
-{%- ifversion fpt %}
* Public repositories on {% data variables.product.prodname_dotcom_the_website %}
-* Organization-owned repositories on {% data variables.product.prodname_team %} with [{% data variables.product.prodname_GH_code_security %}](/get-started/learning-about-github/about-github-advanced-security) enabled
-
-{%- elsif ghec %}
-* Public repositories on {% data variables.product.prodname_dotcom_the_website %}
-* Organization-owned repositories on {% data variables.product.prodname_team %} or {% data variables.product.prodname_ghe_cloud %} with [{% data variables.product.prodname_GH_code_security %}](/get-started/learning-about-github/about-github-advanced-security) enabled
-
-{%- elsif ghes %}
-* Organization-owned repositories with [{% data variables.product.prodname_GH_code_security %}](/get-started/learning-about-github/about-github-advanced-security) enabled
-
-{% endif %}
+* Organization-owned repositories on {% data variables.product.prodname_team %}, {% data variables.product.prodname_ghe_cloud %}, or {% data variables.product.prodname_ghe_server %}, with [{% data variables.product.prodname_GH_code_security %}](/get-started/learning-about-github/about-github-advanced-security) enabled.
diff --git a/data/reusables/gated-features/copilot-cli.md b/data/reusables/gated-features/copilot-cli.md
index 364b5c1ed532..f2687dd3c567 100644
--- a/data/reusables/gated-features/copilot-cli.md
+++ b/data/reusables/gated-features/copilot-cli.md
@@ -1,3 +1 @@
-{% data variables.copilot.copilot_cli %} is available with the {% data variables.copilot.copilot_pro %}, {% data variables.copilot.copilot_pro_plus %}, {% data variables.copilot.copilot_for_business %} and {% data variables.copilot.copilot_enterprise %} plans.
-
-If you receive {% data variables.product.prodname_copilot_short %} from an organization, the {% data variables.copilot.copilot_cli_short %} policy must be enabled in the organization's settings.
+{% data variables.copilot.copilot_cli %} is available with the {% data variables.copilot.copilot_pro %}, {% data variables.copilot.copilot_pro_plus %}, {% data variables.copilot.copilot_for_business %} and {% data variables.copilot.copilot_enterprise %} plans. If you receive {% data variables.product.prodname_copilot_short %} from an organization, the {% data variables.copilot.copilot_cli_short %} policy must be enabled in the organization's settings.
diff --git a/data/reusables/gated-features/copilot-memory.md b/data/reusables/gated-features/copilot-memory.md
new file mode 100644
index 000000000000..b02e4f47c178
--- /dev/null
+++ b/data/reusables/gated-features/copilot-memory.md
@@ -0,0 +1,2 @@
+* Enterprises and organizations with a {% data variables.copilot.copilot_enterprise_short %} or {% data variables.copilot.copilot_business_short %} plan.
+* Individual users with a {% data variables.copilot.copilot_pro_short %} or {% data variables.copilot.copilot_pro_plus_short %} plan.
diff --git a/data/reusables/gated-features/dependabot-alerts.md b/data/reusables/gated-features/dependabot-alerts.md
index 459882ca5361..240fbe452198 100644
--- a/data/reusables/gated-features/dependabot-alerts.md
+++ b/data/reusables/gated-features/dependabot-alerts.md
@@ -1,3 +1 @@
-{% data variables.product.prodname_dependabot_alerts %} is available for the following repositories:
-
- * Organization-owned and user-owned repositories
+{% data variables.product.prodname_dependabot_alerts %} are available for organization-owned and user-owned repositories.
diff --git a/data/reusables/getting-started/configuring-security-features.md b/data/reusables/getting-started/configuring-security-features.md
index 4ba3ffa6bb6f..2cca174c1d3a 100644
--- a/data/reusables/getting-started/configuring-security-features.md
+++ b/data/reusables/getting-started/configuring-security-features.md
@@ -1 +1 @@
-To keep {% ifversion ghes %}the organizations in {% data variables.location.product_location %}{% else %}your organization{% endif %} secure, you can use a variety of {% data variables.product.prodname_dotcom %} security features, including security policies, dependency graphs, secret scanning and Dependabot security and version updates. For more information, see {% ifversion security-configurations %}[AUTOTITLE](/code-security/securing-your-organization).{% else %}[AUTOTITLE](/code-security/getting-started/quickstart-for-securing-your-organization).{% endif %}
+To keep {% ifversion ghes %}the organizations in {% data variables.location.product_location %}{% else %}your organization{% endif %} secure, you can use a variety of {% data variables.product.prodname_dotcom %} security features, including security policies, dependency graphs, secret scanning and Dependabot security and version updates.{% ifversion secret-risk-assessment %} For more information, see [AUTOTITLE](/code-security/securing-your-organization).{% elsif ghes < 3.15 %} For more information, see [AUTOTITLE](/code-security/getting-started/quickstart-for-securing-your-organization).{% endif %}
diff --git a/data/reusables/identity-and-permissions/team-sync-usage-limits.md b/data/reusables/identity-and-permissions/team-sync-usage-limits.md
index e08b2ea38815..e97b5fa26caf 100644
--- a/data/reusables/identity-and-permissions/team-sync-usage-limits.md
+++ b/data/reusables/identity-and-permissions/team-sync-usage-limits.md
@@ -5,3 +5,5 @@ There are usage limits for the team synchronization feature. Exceeding these lim
* Maximum number of members in a GitHub team: 5,000
* Maximum number of members in a GitHub organization: 10,000
* Maximum number of teams in a GitHub organization: 1,500
+
+These limits only apply to the use of the team synchronization feature. Your organization may have more members or teams than the limits above, but your use of the team synchronization feature will be impaired. These limits do not apply to SCIM-based linking of teams to SCIM groups.
\ No newline at end of file
diff --git a/data/reusables/organizations/additional-permissions.md b/data/reusables/organizations/additional-permissions.md
index 4fac34bbeea8..caa9d92d570a 100644
--- a/data/reusables/organizations/additional-permissions.md
+++ b/data/reusables/organizations/additional-permissions.md
@@ -9,7 +9,7 @@
For more information, see [AUTOTITLE](/discussions).
-### Issue and Pull Requests
+### Issue and pull requests
* Assign or remove a user
* Add or remove a label
@@ -21,14 +21,14 @@ For more information, see [AUTOTITLE](/discussions).
* Delete an issue
* Mark an issue as a duplicate
-### Merge Queue
+### Merge queue
* Request a solo merge
* Jump to the front of the queue
For more information, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue).
-### Pull Request
+### Pull request
* Close a pull request
* Reopen a closed pull request
diff --git a/data/reusables/organizations/data_saved_for_reinstating_a_former_org_member.md b/data/reusables/organizations/data_saved_for_reinstating_a_former_org_member.md
deleted file mode 100644
index 090bffd7957b..000000000000
--- a/data/reusables/organizations/data_saved_for_reinstating_a_former_org_member.md
+++ /dev/null
@@ -1,2 +0,0 @@
-> [!NOTE]
-> When you remove a user from your organization, their membership data is saved for three months. You can restore their data, or any private forks they owned of your organization's repositories, if you invite the user to rejoin the organization within that time frame. For more information, see [AUTOTITLE](/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization).
diff --git a/data/reusables/organizations/team-discussions-api-deprecation.md b/data/reusables/organizations/team-discussions-api-deprecation.md
deleted file mode 100644
index 3275cc2bde06..000000000000
--- a/data/reusables/organizations/team-discussions-api-deprecation.md
+++ /dev/null
@@ -1,11 +0,0 @@
-{% ifversion ghes %}
-
-> [!NOTE]
-> The team discussions and team discussion comments endpoints are {% data variables.release-phases.closing_down %} in {% data variables.product.prodname_ghe_server %} 3.13 in favor of {% data variables.product.prodname_discussions %}. For more information about {% data variables.product.prodname_discussions %}, see [AUTOTITLE](/discussions).
-
-{% elsif fpt or ghec %}
-
-> [!NOTE]
-> The team discussions and team discussion comments endpoints are {% data variables.release-phases.closing_down %} on 2023-11-28 in favor of {% data variables.product.prodname_discussions %}. For more information about {% data variables.product.prodname_discussions %}, see [AUTOTITLE](/discussions).
-
-{% endif %}
diff --git a/data/reusables/pull_requests/close-issues-using-keywords.md b/data/reusables/pull_requests/close-issues-using-keywords.md
index 0703c2a32593..5cdad811d4dd 100644
--- a/data/reusables/pull_requests/close-issues-using-keywords.md
+++ b/data/reusables/pull_requests/close-issues-using-keywords.md
@@ -1 +1 @@
-You can link a pull request to an issue to show that a fix is in progress and to automatically close the issue when someone merges the pull request. For more information, see [AUTOTITLE](/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue).
+You can link a pull request to an issue to show that a fix is in progress and automatically close the issue when the pull request is merged. For more information, see [AUTOTITLE](/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue).
diff --git a/data/reusables/pull_requests/code-review-limits.md b/data/reusables/pull_requests/code-review-limits.md
deleted file mode 100644
index 9676d53d3723..000000000000
--- a/data/reusables/pull_requests/code-review-limits.md
+++ /dev/null
@@ -1 +0,0 @@
-By default, in public repositories, any user can submit reviews that approve or request changes to a pull request. Organization owners and repository admins can limit who is able to give approving pull request reviews or request changes. For more information, see [AUTOTITLE](/organizations/managing-organization-settings/managing-pull-request-reviews-in-your-organization) and [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-pull-request-reviews-in-your-repository).
diff --git a/data/reusables/pull_requests/re-request-review.md b/data/reusables/pull_requests/re-request-review.md
deleted file mode 100644
index 5776451f772f..000000000000
--- a/data/reusables/pull_requests/re-request-review.md
+++ /dev/null
@@ -1,2 +0,0 @@
-You can re-request a review, for example, after you've made substantial changes to your pull request.
-To request a fresh review from a reviewer, in the sidebar of the **Conversation** tab, click the {% octicon "sync" aria-label="The sync icon" %} icon.
diff --git a/data/reusables/pull_requests/required-checks-must-pass-to-merge.md b/data/reusables/pull_requests/required-checks-must-pass-to-merge.md
deleted file mode 100644
index 894e9a46026f..000000000000
--- a/data/reusables/pull_requests/required-checks-must-pass-to-merge.md
+++ /dev/null
@@ -1 +0,0 @@
-If status checks are required for a repository, the required status checks must pass before you can merge your branch into the protected branch. For more information, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging).
diff --git a/data/reusables/pull_requests/resolving-conversations.md b/data/reusables/pull_requests/resolving-conversations.md
deleted file mode 100644
index 83d1c02c6669..000000000000
--- a/data/reusables/pull_requests/resolving-conversations.md
+++ /dev/null
@@ -1,17 +0,0 @@
-### Resolving conversations
-
-You can resolve a conversation in a pull request if you opened the pull request or if you have write access to the repository where the pull request was opened.
-
-To indicate that a conversation on the **Files changed** tab is complete, click **Resolve conversation**.
-
-The entire conversation will be collapsed and marked as resolved, making it easier to find conversations that still need to be addressed.
-
-If the suggestion in a comment is out of your pull request's scope, you can open a new issue that tracks the feedback and links back to the original comment. For more information, see [AUTOTITLE](/issues/tracking-your-work-with-issues/creating-an-issue).
-
-#### Discovering and navigating conversations
-
-You can discover and navigate to all the conversations in your pull request using the **Conversations** menu that's shown at the top of the **Files Changed** tab.
-
-From this view, you can see which conversations are unresolved, resolved, and outdated. This makes it easy to discover and resolve conversations.
-
-
diff --git a/data/reusables/rai/copilot/byok-transparency-note.md b/data/reusables/rai/copilot/byok-transparency-note.md
index 63efeae5d983..bb742ed337bf 100644
--- a/data/reusables/rai/copilot/byok-transparency-note.md
+++ b/data/reusables/rai/copilot/byok-transparency-note.md
@@ -1,6 +1,6 @@
# Using Bring Your Own Key (BYOK) with {% data variables.product.prodname_copilot %}
-When you use Bring Your Own Key with {% data variables.copilot.copilot_chat %}, you can connect the chat experience to large language models from supported providers beyond the default {% data variables.product.prodname_copilot_short %} model. Examples of supported providers include Anthropic, Azure AI, OpenAI, and xAI. You add your API key for the chosen provider directly in your {% data variables.product.prodname_copilot_short %} settings.
+When you use Bring Your Own Key with {% data variables.copilot.copilot_chat %}, you can connect the chat experience to large language models from supported providers beyond the default {% data variables.product.prodname_copilot_short %} model. Examples of supported providers include Anthropic, AWS Bedrock, Google AI Studio, Microsoft Foundry, OpenAI, OpenAI-compatible providers, and xAI. You add your API key for the chosen provider directly in your {% data variables.product.prodname_copilot_short %} settings.
When BYOK is active:
diff --git a/data/reusables/repositories/dependency-review.md b/data/reusables/repositories/dependency-review.md
deleted file mode 100644
index 4a63b03bb65e..000000000000
--- a/data/reusables/repositories/dependency-review.md
+++ /dev/null
@@ -1 +0,0 @@
-Additionally, {% data variables.product.prodname_dotcom %} can review any dependencies added, updated, or removed in a pull request made against the default branch of a repository, and flag any changes that would reduce the security of your project. This allows you to spot and deal with vulnerable dependencies before, rather than after, they reach your codebase. For more information, see [AUTOTITLE](/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-dependency-changes-in-a-pull-request).
diff --git a/data/reusables/repositories/legacy-issue-template-tip.md b/data/reusables/repositories/legacy-issue-template-tip.md
deleted file mode 100644
index b4f3a6f294ec..000000000000
--- a/data/reusables/repositories/legacy-issue-template-tip.md
+++ /dev/null
@@ -1,2 +0,0 @@
-> [!WARNING]
-> This is the legacy workflow to create an issue template. We recommend using the upgraded multiple issue template builder or issue forms to create issue templates. For more information, see [AUTOTITLE](/communities/using-templates-to-encourage-useful-issues-and-pull-requests/about-issue-and-pull-request-templates).
diff --git a/data/reusables/repositories/request-changes-tips.md b/data/reusables/repositories/request-changes-tips.md
index 4bec3fc6ea11..d3a259ed9466 100644
--- a/data/reusables/repositories/request-changes-tips.md
+++ b/data/reusables/repositories/request-changes-tips.md
@@ -2,8 +2,8 @@
> * The **Request changes** option is purely informational and will not prevent merging unless a ruleset or classic branch protection rule is configured with the "require a pull request" option. If configured and a collaborator with `admin`, `owner`, or `write` access to the repository submits a review requesting changes, the pull request cannot be merged until the same collaborator submits another review approving the changes in the pull request.
> * Repository owners and administrators can merge a pull request even if it hasn't received an approving review, or if a reviewer who requested changes has left the organization or is unavailable.
> * If both required reviews and stale review dismissal are enabled and a code-modifying commit is pushed to the branch of an approved pull request, the approval is dismissed. The pull request must be reviewed and approved again before it can be merged.
-> * When several open pull requests each have a head branch pointing to the same commit, you wonāt be able to merge them if one or both have a pending or rejected review.
+> * When several open pull requests each have a head branch pointing to the same commit, you wonāt be able to merge them if one or both have a pending or rejected review. {% ifversion fpt or ghec or ghes > 3.18 %}
> * If your repository requires approving reviews from people with write or admin permissions, the reviewers sidebar groups approvals by permission level. Approvals can appear in two sections:
> * The **top section** mostly contains approvals from people with write or admin permissions that count toward merge requirements. Approvals by {% data variables.product.prodname_copilot %} also appear in this section even though {% data variables.product.prodname_copilot %} reviews do not count toward those requirements.
-> * The **collapsible section (if present)** shows approvals from reviewers whose reviews do not affect whether the pull request can be merged.
+> * The **collapsible section (if present)** shows approvals from reviewers whose reviews do not affect whether the pull request can be merged. {% endif %}
> * Pull request authors cannot approve their own pull requests.{% ifversion copilot %} You will also not be able to approve a pull request that was raised by {% data variables.product.prodname_copilot %} if it was you who assigned {% data variables.product.prodname_copilot_short %} to the issue to which the pull request relates.{% endif %}
diff --git a/data/reusables/repositories/rulesets-metadata-restrictions-notes.md b/data/reusables/repositories/rulesets-metadata-restrictions-notes.md
index 75aa039400be..1bd56d4f7908 100644
--- a/data/reusables/repositories/rulesets-metadata-restrictions-notes.md
+++ b/data/reusables/repositories/rulesets-metadata-restrictions-notes.md
@@ -1 +1,4 @@
-> [!NOTE] If you squash merge a branch, all commits on that branch must meet any metadata requirements for the base branch.
+> [!NOTE]
+> If you squash merge a branch, all commits on that branch must meet any metadata requirements for the base branch.
+>
+> When using end-of-line anchors in regular expressions, use `\n?$` rather than `$` alone. The optional `\n?` matches a trailing newline that may be present in Git push/CLI flows, while still working for commits created via the web UI and API.
diff --git a/data/reusables/rest-api/about-api-versions.md b/data/reusables/rest-api/about-api-versions.md
index 0875319e0bd9..f6aece67bb61 100644
--- a/data/reusables/rest-api/about-api-versions.md
+++ b/data/reusables/rest-api/about-api-versions.md
@@ -1,6 +1,6 @@
The {% data variables.product.github %} REST API is versioned. The API version name is based on the date when the API version was released. For example, the API version `{{ initialRestVersioningReleaseDate }}` was released on {{ initialRestVersioningReleaseDateLong }}.
-Any breaking changes will be released in a new API version. Breaking changes are changes that can potentially break an integration. Breaking changes include:
+Breaking changes are changes that can potentially break an integration. We will provide advance notice before releasing breaking changes. Breaking changes include:
* Removing an entire operation
* Removing or renaming a parameter
diff --git a/data/reusables/rest-api/primary-rate-limit-authenticated-users.md b/data/reusables/rest-api/primary-rate-limit-authenticated-users.md
index c80404330080..193c88729873 100644
--- a/data/reusables/rest-api/primary-rate-limit-authenticated-users.md
+++ b/data/reusables/rest-api/primary-rate-limit-authenticated-users.md
@@ -1,4 +1,3 @@
You can use a {% data variables.product.pat_generic %} to make API requests. Additionally, you can authorize a {% data variables.product.prodname_github_app %} or {% data variables.product.prodname_oauth_app %}, which can then make API requests on your behalf.
- All of these requests count towards your personal rate limit of 5,000 requests per hour. {% ifversion fpt or ghec %}Requests made on your behalf by a {% data variables.product.prodname_github_app %} that is owned by a {% data variables.product.prodname_ghe_cloud %} organization have a higher rate limit of 15,000 requests per hour. Similarly, requests made on your behalf by a {% data variables.product.prodname_oauth_app %} that is owned or approved by a {% data variables.product.prodname_ghe_cloud %} organization have a higher rate limit of 15,000 requests per hour if you are a member of the {% data variables.product.prodname_ghe_cloud %} organization.{% endif %}
-
\ No newline at end of file
+ All of these requests count towards your personal rate limit of 5,000 requests per hour. {% ifversion fpt or ghec %}Requests made on your behalf by a {% data variables.product.prodname_github_app %} that is owned by a {% data variables.product.prodname_ghe_cloud %} organization have a higher rate limit of 15,000 requests per hour. Similarly, requests made on your behalf by a {% data variables.product.prodname_oauth_app %} that is owned or approved by a {% data variables.product.prodname_ghe_cloud %} organization have a higher rate limit of 15,000 requests per hour if you are a member of the {% data variables.product.prodname_ghe_cloud %} organization. However, requests made by a higher-limit app reduce the remaining budget available for lower-limit authentication methods. For example, if an app with a 15,000 request limit makes 10,000 requests on your behalf, you will have exhausted the 5,000 request budget for your {% data variables.product.pat_generic_plural %}, even though the app has 5,000 requests remaining.{% endif %}
diff --git a/data/reusables/search/requested_reviews_search_tip.md b/data/reusables/search/requested_reviews_search_tip.md
deleted file mode 100644
index 8a6ecf2e0f50..000000000000
--- a/data/reusables/search/requested_reviews_search_tip.md
+++ /dev/null
@@ -1,2 +0,0 @@
-> [!TIP]
-> You can find a pull request where you or a team you're a member of is requested for review with the search qualifier `review-requested:[USERNAME]` or `team-review-requested:[TEAMNAME]`. For more information, see [AUTOTITLE](/search-github/searching-on-github/searching-issues-and-pull-requests).
diff --git a/data/reusables/secret-protection/product-list.md b/data/reusables/secret-protection/product-list.md
index 2f5723b42188..026ae8de0a34 100644
--- a/data/reusables/secret-protection/product-list.md
+++ b/data/reusables/secret-protection/product-list.md
@@ -1,15 +1,8 @@
* **{% data variables.product.prodname_secret_scanning_caps %}**: Detect secrets, for example keys and tokens, that have been checked into a repository and receive alerts.
-
-* **Push protection**: Prevent secret leaks before they happen by blocking commits containing secrets. {% ifversion fpt or ghec or ghes > 3.19 %} You can calculate how much you can save by using push protection in repositories in your organization with the {% data variables.secret-scanning.roi-calculator %}. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/calculating-the-cost-savings-of-push-protection).{% endif %}{% ifversion secret-scanning-ai-generic-secret-detection %}
-
+* **Push protection**: Prevent secret leaks before they happen by blocking commits containing secrets.{% ifversion secret-scanning-ai-generic-secret-detection %}
* **{% data variables.secret-scanning.copilot-secret-scanning %}**: Leverage AI to detect unstructured credentials, such as passwords, that have been checked into a repository.{% endif %}
-
* **Custom patterns**: Detect and prevent leaks for organization-specific secrets.{% ifversion security-delegated-alert-dismissal %}
-
* **Delegated bypass for push protection** and **Delegated alert dismissal**: Implement an approval process for better control over who in your enterprise can perform sensitive actions, supporting governance at scale.{% elsif ghes = 3.15 or ghes = 3.16 %}
-
* **Delegated bypass for push protection**: Implement controls over who can bypass push protection.{% endif %}{% ifversion security-campaigns-secrets %}
-
-* **Security campaigns**: remediate exposed secrets at scale by creating a campaign and collaborating to fix them.{% endif %}
-
+* **Security campaigns**: Remediate exposed secrets at scale by creating a campaign and collaborating to fix them.{% endif %}
* **Security overview**: Understand the distribution of risk across your organization.
diff --git a/data/reusables/secret-risk-assessment/report-intro.md b/data/reusables/secret-risk-assessment/report-intro.md
deleted file mode 100644
index b9aef4d584e6..000000000000
--- a/data/reusables/secret-risk-assessment/report-intro.md
+++ /dev/null
@@ -1,4 +0,0 @@
-{% data variables.product.company_short %} provides a **secret risk assessment** report that organization owners and security managers can generate to evaluate the exposure of an organization to leaked secrets. The {% data variables.product.prodname_secret_risk_assessment %} is an **on-demand, point-in-time scan** of the code within an organization that:
-* Shows any leaked secrets within the organization
-* Shows the kinds of secrets that are leaked outside the organization
-* Provides actionable insights for remediation
diff --git a/data/reusables/secret-risk-assessment/what-is-scanned.md b/data/reusables/secret-risk-assessment/what-is-scanned.md
deleted file mode 100644
index 7e9e709e95d0..000000000000
--- a/data/reusables/secret-risk-assessment/what-is-scanned.md
+++ /dev/null
@@ -1 +0,0 @@
-The free {% data variables.product.prodname_secret_risk_assessment %} scans _only the code_ in your organization, including the code in archived repositories. You can extend the surface being scanned to cover content in pull requests, issues, wikis, and {% data variables.product.prodname_discussions %} with **{% data variables.product.prodname_GH_secret_protection %}**.
diff --git a/data/reusables/secret-scanning/alert-type-links.md b/data/reusables/secret-scanning/alert-type-links.md
deleted file mode 100644
index 2726f22f8340..000000000000
--- a/data/reusables/secret-scanning/alert-type-links.md
+++ /dev/null
@@ -1 +0,0 @@
-For more information, see {% ifversion fpt or ghec %}[AUTOTITLE](/code-security/secret-scanning/managing-alerts-from-secret-scanning/about-alerts#about-user-alerts){% elsif ghes %}[AUTOTITLE](/code-security/secret-scanning/managing-alerts-from-secret-scanning/about-alerts#about-secret-scanning-alerts){% endif %}.
diff --git a/data/reusables/secret-scanning/what-is-scanned.md b/data/reusables/secret-scanning/what-is-scanned.md
index f19c5b340cdb..bbc061ef39ff 100644
--- a/data/reusables/secret-scanning/what-is-scanned.md
+++ b/data/reusables/secret-scanning/what-is-scanned.md
@@ -1,12 +1,8 @@
-Additionally, {% data variables.product.prodname_secret_scanning %} scans:
* Descriptions and comments in issues
* Titles, descriptions, and comments, in open and closed _historical_ issues{% ifversion fpt or ghec %}. A notification is sent to the relevant partner when a historical partner pattern is detected.{% endif %}
* Titles, descriptions, and comments in pull requests
* Titles, descriptions, and comments in {% data variables.product.prodname_discussions %}{% ifversion secret-scanning-enhancements-wikis %}
* Wikis{% endif %}
-
-{% ifversion fpt or ghec %}
-This additional scanning is free for public repositories.
-{% endif %}
+* Secret gists. A notification is sent to the relevant partner when a partner pattern is detected in a secret gist.
{% data reusables.secret-scanning.beta-prs-discussions-wikis-scanned %}
diff --git a/data/reusables/security-overview/choose-alert-dismissal-request-view.md b/data/reusables/security-overview/choose-alert-dismissal-request-view.md
new file mode 100644
index 000000000000..0c727ccf569c
--- /dev/null
+++ b/data/reusables/security-overview/choose-alert-dismissal-request-view.md
@@ -0,0 +1,4 @@
+1. In the "Requests" section of the sidebar, click any of the following options to review alert dismissal requests for the relevant feature:
+ * {% octicon "key" aria-hidden="true" aria-label="key" %} **{% data variables.product.prodname_secret_scanning_caps %} alert dismissal**
+ * {% octicon "codescan" aria-hidden="true" aria-label="codescan" %} **{% data variables.product.prodname_code_scanning_caps %} alert dismissal**{% ifversion dependabot-delegated-alert-dismissal %}
+ * {% octicon "dependabot" aria-hidden="true" aria-label="dependabot" %} **{% data variables.product.prodname_dependabot %} alert dismissal**{% endif %}
diff --git a/data/reusables/security-overview/review-an-alert-dismissal-request.md b/data/reusables/security-overview/review-an-alert-dismissal-request.md
new file mode 100644
index 000000000000..d10acf39277c
--- /dev/null
+++ b/data/reusables/security-overview/review-an-alert-dismissal-request.md
@@ -0,0 +1,5 @@
+1. Click the request you want to review.
+1. Read the contents of the alert, as well as the requester's reasoning for the dismissal request.
+1. Next to the dismissal request in the alert timeline, click **Review request**.
+1. Provide any comments for the requester in the text box, then select either **Deny request** or **Approve request**.
+1. Click **Submit review**.
diff --git a/data/reusables/security-overview/secret-risk-assessment-report-generation-cadence.md b/data/reusables/security-overview/secret-risk-assessment-report-generation-cadence.md
deleted file mode 100644
index a236c8b60c8d..000000000000
--- a/data/reusables/security-overview/secret-risk-assessment-report-generation-cadence.md
+++ /dev/null
@@ -1 +0,0 @@
-> [!TIP] You can only generate the report once every 90 days. We recommend that you implement {% data variables.product.prodname_GH_secret_protection %} for continuous secret monitoring and prevention. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/choosing-github-secret-protection).
diff --git a/data/reusables/security/alert-assignee-mention.md b/data/reusables/security/alert-assignee-mention.md
index 484ed7c454d2..487d7690b16d 100644
--- a/data/reusables/security/alert-assignee-mention.md
+++ b/data/reusables/security/alert-assignee-mention.md
@@ -1,5 +1,5 @@
{% ifversion code-secret-alert-assignees %}
-In addition, you will receive a notification if someone assigns a {% data variables.product.prodname_secret_scanning %} alert to you, see [Assigning alerts](/code-security/securing-your-organization/fixing-security-alerts-at-scale/about-security-campaigns#assigning-alerts).
+In addition, you will receive a notification if someone assigns a {% data variables.product.prodname_code_scanning %} or a {% data variables.product.prodname_secret_scanning %} alert to you, see [Assigning alerts](/code-security/securing-your-organization/fixing-security-alerts-at-scale/about-security-campaigns#assigning-alerts).
{% endif %}
diff --git a/data/reusables/security/compliance-report-list.md b/data/reusables/security/compliance-report-list.md
index cee554785e01..ca4593832f53 100644
--- a/data/reusables/security/compliance-report-list.md
+++ b/data/reusables/security/compliance-report-list.md
@@ -1,14 +1,14 @@
{%- ifversion ghec %}
* SOC 1, Type 2
-* SOC 2, Type 1 ({% data variables.copilot.copilot_for_business %} only)
* SOC 2, Type 2
{%- elsif fpt %}
* SOC 3
{%- endif %}
* Cloud Security Alliance CAIQ self-assessment (CSA CAIQ - Level 1)
-* ISO/IEC 27001:2013 certification
+* ISO/IEC 27001:2022 certification
{%- ifversion ghec %}
* Cloud Security Alliance STAR certification (CSA STAR - Level 2)
* {% data variables.product.github %} Bug Bounty Quarterly reports
* {% data variables.product.prodname_dotcom_the_website %} Services Continuity and Incident Management Plan
+* {% data variables.product.github %} PCI DSS Attestation of Compliance
{%- endif %}
diff --git a/data/reusables/security/delegated-alert-dismissal-intro.md b/data/reusables/security/delegated-alert-dismissal-intro.md
index 79b0dcb4711b..257d6b93e895 100644
--- a/data/reusables/security/delegated-alert-dismissal-intro.md
+++ b/data/reusables/security/delegated-alert-dismissal-intro.md
@@ -1,23 +1,13 @@
-Delegated alert dismissal lets you restrict which users can directly dismiss an alert. When the feature is enabled, users attempting to dismiss an alert will instead create a request for dismissal.
+Delegated alert dismissal lets you restrict which users can directly dismiss an alert. When the feature is enabled:
+* Users with write access to a repository must request to dismiss alerts in that repository.
+* Organization owners and security managers can approve or deny dismissal requests, as well as dismiss alerts directly themselves.
-Enabling the feature automatically assigns organization owners and security managers with the permission to approve or deny dismissal requests for alerts. This permission is:
+You can also use custom roles with the following permissions to let other team members manage requests and dismiss alerts directly:
-* "Review and manage {% data variables.product.prodname_code_scanning %} alert dismissal requests" permission for {% data variables.product.prodname_code_scanning %}.
+* For {% data variables.product.prodname_code_scanning %}: "Review {% data variables.product.prodname_code_scanning %} alert dismissal requests" and "Bypass {% data variables.product.prodname_code_scanning %} alert dismissal requests"
+* For {% data variables.product.prodname_secret_scanning %}: "Review and manage {% data variables.product.prodname_secret_scanning %} alert dismissal requests"
+* For {% data variables.product.prodname_dependabot %}: "Review {% data variables.product.prodname_dependabot %} alert dismissal requests" and "Bypass {% data variables.product.prodname_dependabot %} alert dismissal requests"
-* "Review and manage {% data variables.product.prodname_secret_scanning %} alert dismissal requests" permission for {% data variables.product.prodname_secret_scanning %}. This permission can also be applied to custom roles. Individuals in these custom roles must also have the following permissions, which grant access to alerts in all repositories:
+Reviewers are notified of dismissal requests via email, and can either approve the request to dismiss the alert, or deny the request to leave the alert open. After a request is reviewed, the requester is notified of the outcome via email.
- * "View {% data variables.product.prodname_secret_scanning %} alerts"
- * "Dismiss or reopen {% data variables.product.prodname_secret_scanning %} alerts"
-
-For more information about these permissions, see [AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#permissions-for-organization-roles).
-
-To learn more about the security manager role, see [AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization).
-
->[!NOTE] The implementation of this approval process can potentially cause some friction, so it's important to ensure that the team of security managers has adequate coverage before proceeding.
-
-Reviewers (security managers and organization owners):
-
-* Get an email notification for requests. These users need to ensure that they can review these lists periodically, so that there is no backlog and that the process is smooth.
-* Can process requests in a dedicated view in the "Security" tab of the organization. An alert will only be dismissed if the dismissal request is approved; otherwise, the alert will remain open.
-
-Requesters will get an email notification with the decision as to whether the alert can be dismissed or not.
+>[!NOTE] The implementation of this approval process can potentially cause some friction, so it's important to ensure that the team of security managers has adequate coverage to review dismissal requests regularly before proceeding.
diff --git a/data/reusables/security/production-context-mdc-preview.md b/data/reusables/security/production-context-mdc-preview.md
index 83b2160f776d..f75d4892f11f 100644
--- a/data/reusables/security/production-context-mdc-preview.md
+++ b/data/reusables/security/production-context-mdc-preview.md
@@ -1,2 +1,2 @@
> [!NOTE]
-> Production context and the integration with {% data variables.product.prodname_microsoft_defender %} is in {% data variables.release-phases.public_preview %} and subject to change.
+> The integration with {% data variables.product.prodname_microsoft_defender %} is in {% data variables.release-phases.public_preview %} and subject to change.
diff --git a/data/reusables/support/premium-support-features.md b/data/reusables/support/premium-support-features.md
index cd71dbc86556..aab463a67186 100644
--- a/data/reusables/support/premium-support-features.md
+++ b/data/reusables/support/premium-support-features.md
@@ -8,7 +8,7 @@ In addition to all of the benefits of {% data variables.contact.enterprise_suppo
* Access to premium content
* Health checks
{%- ifversion ghes %}
-* Crisis prevention: Guided incident simulations that help you prepare forāand experienceāan incident without risk. ({% data variables.product.premium_plus_support_plan %} only)
+* Crisis prevention: Guided incident simulations that help you prepare forāand experienceāan incident without risk. ({% data variables.product.premium_plus_support_plan %} / {% data variables.product.microsoft_premium_plus_support_plan %} only)
{%- endif %}
-* Application upgrade assistance: Before your upgrade, we review your upgrade plans, playbooks, and other documentation and answer questions specific to your environment ({% data variables.product.premium_plus_support_plan %} only)
-* Technical advisory hours ({% data variables.product.premium_plus_support_plan %} only)
+* Application upgrade assistance: Before your upgrade, we review your upgrade plans, playbooks, and other documentation and answer questions specific to your environment ({% data variables.product.premium_plus_support_plan %} / {% data variables.product.microsoft_premium_plus_support_plan %} only)
+* Technical advisory hours ({% data variables.product.premium_plus_support_plan %} / {% data variables.product.microsoft_premium_plus_support_plan %} only)
diff --git a/data/reusables/support/scope-of-support.md b/data/reusables/support/scope-of-support.md
index 4575b418f42c..b189d8bb9009 100644
--- a/data/reusables/support/scope-of-support.md
+++ b/data/reusables/support/scope-of-support.md
@@ -13,6 +13,7 @@ If your support request is outside of the scope of what our team can help you wi
* Cloud provider configurations, such as virtual network setup, custom firewall, or proxy rules
* Container orchestration, such as Kubernetes setup, or networking
* Detailed assistance with workflows and data management
+* Comprehensive support for customization and tool installation on {% data variables.product.prodname_actions %} custom images
* Preview features. {% data variables.release-phases.public_preview_caps %}, {% data variables.release-phases.private_preview %}, and {% data variables.release-phases.technical_preview %} features are out of {% data variables.contact.github_support %}'s scope.
* {% data variables.product.prodname_copilot %} suggestions
diff --git a/data/reusables/support/submit-a-ticket.md b/data/reusables/support/submit-a-ticket.md
index cd3ef282be0c..19085e9c5853 100644
--- a/data/reusables/support/submit-a-ticket.md
+++ b/data/reusables/support/submit-a-ticket.md
@@ -9,7 +9,7 @@
1. Select the **Select personal account, enterprise account or organization** dropdown menu and click the name of the account your support ticket is regarding.
> [!NOTE]
- > * For Premium, Premium Plus, or Engineering Direct support, you need to choose an enterprise account with a {% data variables.contact.premium_support %} plan. If you don't see an Enterprises section in the dropdown menu, you're not entitled to open support tickets on behalf of an enterprise account. For more information, see [AUTOTITLE](/support/learning-about-github-support/about-github-support#about-support-entitlement)
+ > * For {% data variables.product.premium_support_plan %}, {% data variables.product.premium_plus_support_plan %}, or {% data variables.product.microsoft_premium_plus_support_plan %} support, you need to choose an enterprise account with a {% data variables.contact.premium_support %} plan. If you don't see an Enterprises section in the dropdown menu, you're not entitled to open support tickets on behalf of an enterprise account. For more information, see [AUTOTITLE](/support/learning-about-github-support/about-github-support#about-support-entitlement)
> * To see a list of your enterprise accounts with a {% data variables.contact.premium_support %} plan, you must be signed into the {% data variables.contact.enterprise_portal %}. For more information, see [AUTOTITLE](/support/contacting-github-support/getting-your-enterprise-started-with-the-github-support-portal).
{% endif %}
diff --git a/data/reusables/webhooks/pull_request_event_api_properties.md b/data/reusables/webhooks/pull_request_event_api_properties.md
index afed567c4c5b..807cbad1acaf 100644
--- a/data/reusables/webhooks/pull_request_event_api_properties.md
+++ b/data/reusables/webhooks/pull_request_event_api_properties.md
@@ -1,7 +1,7 @@
Key | Type | Description
----|------|-------------
| {% ifversion fpt or ghec %} |
-`action`|`string` | The action that was performed. Can be one of `opened`, `closed`, `reopened`, `assigned`, `unassigned`, `labeled`, and `unlabeled`.
+`action`|`string` | The action that was performed. Can be one of `opened`, `closed`, `merged`, `reopened`, `assigned`, `unassigned`, `labeled`, or `unlabeled`.
| {% else %} |
`action`|`string` | The action that was performed. Can be one of `opened`, `closed`, `reopened`.
| {% endif %} |
diff --git a/data/tables/copilot/copilot-matrix.yml b/data/tables/copilot/copilot-matrix.yml
new file mode 100644
index 000000000000..076b6f5db89e
--- /dev/null
+++ b/data/tables/copilot/copilot-matrix.yml
@@ -0,0 +1,2219 @@
+# NOTE: Within each IDE, versionGroups must be sorted in descending order
+# (newest releases first within each group).
+
+metadata:
+ title: GitHub Copilot IDE Feature Matrix
+ supportLevels:
+ - not-supported
+ - preview
+ - supported
+ides:
+ VS Code:
+ versions:
+ - 1.108.0
+ - 1.107.0
+ - 1.106.0
+ - 1.105.0
+ - 1.104.0
+ - 1.103.0
+ - 1.102.0
+ - 1.101.0
+ - 1.100.0
+ - 1.99.0
+ - 1.98.0
+ - 1.97.0
+ - 1.96.0
+ - 1.95.0
+ - 1.94.0
+ - 1.80.0
+ - 1.70.0
+ - 1.60.0
+ - 1.57.0
+ - 0.0.0
+ versionGroups:
+ latest releases:
+ - 1.108.0
+ - 1.107.0
+ - 1.106.0
+ - 1.105.0
+ - 1.104.0
+ 2025 releases:
+ - 1.108.0
+ - 1.107.0
+ - 1.106.0
+ - 1.105.0
+ - 1.104.0
+ - 1.103.0
+ - 1.102.0
+ - 1.101.0
+ - 1.100.0
+ - 1.99.0
+ - 1.98.0
+ - 1.97.0
+ 2024 releases:
+ - 1.96.0
+ - 1.95.0
+ - 1.94.0
+ 2023 releases:
+ - 1.80.0
+ 2022 releases:
+ - 1.70.0
+ 2021 releases:
+ - 1.60.0
+ - 1.57.0
+ features:
+ .NET Upgrade Agent:
+ 1.108.0: not-supported
+ 1.107.0: not-supported
+ 1.106.0: not-supported
+ 1.105.0: not-supported
+ 1.104.0: not-supported
+ 1.103.0: not-supported
+ 1.102.0: not-supported
+ 1.101.0: not-supported
+ 1.100.0: not-supported
+ 1.99.0: not-supported
+ 1.98.0: not-supported
+ 1.97.0: not-supported
+ 1.96.0: not-supported
+ 1.95.0: not-supported
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Agent skills:
+ 1.108.0: supported
+ 1.107.0: not-supported
+ 1.106.0: not-supported
+ 1.105.0: not-supported
+ 1.104.0: not-supported
+ 1.103.0: not-supported
+ 1.102.0: not-supported
+ 1.101.0: not-supported
+ 1.100.0: not-supported
+ 1.99.0: not-supported
+ 1.98.0: not-supported
+ 1.97.0: not-supported
+ 1.96.0: not-supported
+ 1.95.0: not-supported
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Agent mode:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: supported
+ 1.105.0: supported
+ 1.104.0: supported
+ 1.103.0: supported
+ 1.102.0: supported
+ 1.101.0: supported
+ 1.100.0: supported
+ 1.99.0: supported
+ 1.98.0: preview
+ 1.97.0: preview
+ 1.96.0: not-supported
+ 1.95.0: not-supported
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ BYOK:
+ 1.108.0: preview
+ 1.107.0: preview
+ 1.106.0: preview
+ 1.105.0: preview
+ 1.104.0: preview
+ 1.103.0: preview
+ 1.102.0: preview
+ 1.101.0: preview
+ 1.100.0: preview
+ 1.99.0: preview
+ 1.98.0: preview
+ 1.97.0: preview
+ 1.96.0: preview
+ 1.95.0: preview
+ 1.94.0: preview
+ 1.80.0: preview
+ 1.70.0: preview
+ 1.60.0: preview
+ 1.57.0: preview
+ 0.0.0: preview
+ Chat:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: supported
+ 1.105.0: supported
+ 1.104.0: supported
+ 1.103.0: supported
+ 1.102.0: supported
+ 1.101.0: supported
+ 1.100.0: supported
+ 1.99.0: supported
+ 1.98.0: supported
+ 1.97.0: supported
+ 1.96.0: supported
+ 1.95.0: supported
+ 1.94.0: supported
+ 1.80.0: supported
+ 1.70.0: supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Checkpoints:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: supported
+ 1.105.0: supported
+ 1.104.0: supported
+ 1.103.0: supported
+ 1.102.0: not-supported
+ 1.101.0: not-supported
+ 1.100.0: not-supported
+ 1.99.0: not-supported
+ 1.98.0: not-supported
+ 1.97.0: not-supported
+ 1.96.0: not-supported
+ 1.95.0: not-supported
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Code completion:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: supported
+ 1.105.0: supported
+ 1.104.0: supported
+ 1.103.0: supported
+ 1.102.0: supported
+ 1.101.0: supported
+ 1.100.0: supported
+ 1.99.0: supported
+ 1.98.0: supported
+ 1.97.0: supported
+ 1.96.0: supported
+ 1.95.0: supported
+ 1.94.0: supported
+ 1.80.0: supported
+ 1.70.0: supported
+ 1.60.0: supported
+ 1.57.0: preview
+ 0.0.0: not-supported
+ Code referencing:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: supported
+ 1.105.0: supported
+ 1.104.0: supported
+ 1.103.0: supported
+ 1.102.0: supported
+ 1.101.0: supported
+ 1.100.0: supported
+ 1.99.0: supported
+ 1.98.0: supported
+ 1.97.0: supported
+ 1.96.0: supported
+ 1.95.0: supported
+ 1.94.0: supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Copilot code review:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: supported
+ 1.105.0: supported
+ 1.104.0: supported
+ 1.103.0: supported
+ 1.102.0: supported
+ 1.101.0: supported
+ 1.100.0: supported
+ 1.99.0: supported
+ 1.98.0: preview
+ 1.97.0: preview
+ 1.96.0: preview
+ 1.95.0: preview
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Custom agents:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: preview
+ 1.105.0: preview
+ 1.104.0: preview
+ 1.103.0: preview
+ 1.102.0: preview
+ 1.101.0: preview
+ 1.100.0: not-supported
+ 1.99.0: not-supported
+ 1.98.0: not-supported
+ 1.97.0: not-supported
+ 1.96.0: not-supported
+ 1.95.0: not-supported
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Custom chat modes:
+ 1.108.0: preview
+ 1.107.0: preview
+ 1.106.0: preview
+ 1.105.0: preview
+ 1.104.0: preview
+ 1.103.0: preview
+ 1.102.0: preview
+ 1.101.0: preview
+ 1.100.0: not-supported
+ 1.99.0: not-supported
+ 1.98.0: not-supported
+ 1.97.0: not-supported
+ 1.96.0: not-supported
+ 1.95.0: not-supported
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Custom instructions:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: supported
+ 1.105.0: supported
+ 1.104.0: supported
+ 1.103.0: supported
+ 1.102.0: supported
+ 1.101.0: supported
+ 1.100.0: supported
+ 1.99.0: supported
+ 1.98.0: supported
+ 1.97.0: preview
+ 1.96.0: preview
+ 1.95.0: preview
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Edit mode:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: supported
+ 1.105.0: supported
+ 1.104.0: supported
+ 1.103.0: supported
+ 1.102.0: supported
+ 1.101.0: supported
+ 1.100.0: supported
+ 1.99.0: supported
+ 1.98.0: supported
+ 1.97.0: supported
+ 1.96.0: preview
+ 1.95.0: preview
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Extensions:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: supported
+ 1.105.0: supported
+ 1.104.0: supported
+ 1.103.0: supported
+ 1.102.0: supported
+ 1.101.0: supported
+ 1.100.0: supported
+ 1.99.0: supported
+ 1.98.0: supported
+ 1.97.0: supported
+ 1.96.0: supported
+ 1.95.0: supported
+ 1.94.0: supported
+ 1.80.0: supported
+ 1.70.0: supported
+ 1.60.0: supported
+ 1.57.0: supported
+ 0.0.0: supported
+ Java Upgrade Agent:
+ 1.108.0: preview
+ 1.107.0: preview
+ 1.106.0: preview
+ 1.105.0: preview
+ 1.104.0: preview
+ 1.103.0: preview
+ 1.102.0: preview
+ 1.101.0: preview
+ 1.100.0: preview
+ 1.99.0: preview
+ 1.98.0: preview
+ 1.97.0: preview
+ 1.96.0: preview
+ 1.95.0: preview
+ 1.94.0: preview
+ 1.80.0: preview
+ 1.70.0: preview
+ 1.60.0: preview
+ 1.57.0: preview
+ 0.0.0: preview
+ MCP:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: supported
+ 1.105.0: supported
+ 1.104.0: supported
+ 1.103.0: supported
+ 1.102.0: supported
+ 1.101.0: preview
+ 1.100.0: preview
+ 1.99.0: preview
+ 1.98.0: not-supported
+ 1.97.0: not-supported
+ 1.96.0: not-supported
+ 1.95.0: not-supported
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Next edit suggestions:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: supported
+ 1.105.0: supported
+ 1.104.0: supported
+ 1.103.0: supported
+ 1.102.0: supported
+ 1.101.0: supported
+ 1.100.0: supported
+ 1.99.0: supported
+ 1.98.0: preview
+ 1.97.0: preview
+ 1.96.0: not-supported
+ 1.95.0: not-supported
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Prompt files:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: preview
+ 1.105.0: preview
+ 1.104.0: preview
+ 1.103.0: preview
+ 1.102.0: preview
+ 1.101.0: preview
+ 1.100.0: preview
+ 1.99.0: preview
+ 1.98.0: preview
+ 1.97.0: preview
+ 1.96.0: not-supported
+ 1.95.0: not-supported
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Vision:
+ 1.108.0: preview
+ 1.107.0: preview
+ 1.106.0: preview
+ 1.105.0: preview
+ 1.104.0: preview
+ 1.103.0: preview
+ 1.102.0: preview
+ 1.101.0: preview
+ 1.100.0: preview
+ 1.99.0: preview
+ 1.98.0: preview
+ 1.97.0: preview
+ 1.96.0: not-supported
+ 1.95.0: not-supported
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Workspace indexing:
+ 1.108.0: supported
+ 1.107.0: supported
+ 1.106.0: supported
+ 1.105.0: supported
+ 1.104.0: supported
+ 1.103.0: supported
+ 1.102.0: supported
+ 1.101.0: supported
+ 1.100.0: supported
+ 1.99.0: supported
+ 1.98.0: supported
+ 1.97.0: supported
+ 1.96.0: supported
+ 1.95.0: supported
+ 1.94.0: not-supported
+ 1.80.0: not-supported
+ 1.70.0: not-supported
+ 1.60.0: not-supported
+ 1.57.0: not-supported
+ 0.0.0: not-supported
+ Visual Studio:
+ versions:
+ - 18.0.0
+ - 17.14.13
+ - 17.14.6
+ - 17.14.0
+ - 17.13.0
+ - 0.0.0
+ versionGroups:
+ latest releases:
+ - 18.0.0
+ - 17.14.13
+ - 17.14.6
+ - 17.14.0
+ - 17.13.0
+ 2025 releases:
+ - 18.0.0
+ - 17.14.13
+ - 17.14.6
+ - 17.14.0
+ - 17.13.0
+ features:
+ .NET Upgrade Agent:
+ 18.0.0: supported
+ 17.14.13: preview
+ 17.14.6: preview
+ 17.14.0: preview
+ 17.13.0: preview
+ 0.0.0: preview
+ Agent skills:
+ 18.0.0: not-supported
+ 17.14.13: not-supported
+ 17.14.6: not-supported
+ 17.14.0: not-supported
+ 17.13.0: not-supported
+ 0.0.0: not-supported
+ Agent mode:
+ 18.0.0: supported
+ 17.14.13: supported
+ 17.14.6: supported
+ 17.14.0: preview
+ 17.13.0: not-supported
+ 0.0.0: not-supported
+ BYOK:
+ 18.0.0: supported
+ 17.14.13: not-supported
+ 17.14.6: not-supported
+ 17.14.0: not-supported
+ 17.13.0: not-supported
+ 0.0.0: not-supported
+ Chat:
+ 18.0.0: supported
+ 17.14.13: supported
+ 17.14.6: supported
+ 17.14.0: supported
+ 17.13.0: supported
+ 0.0.0: supported
+ Code completion:
+ 18.0.0: supported
+ 17.14.13: supported
+ 17.14.6: supported
+ 17.14.0: supported
+ 17.13.0: supported
+ 0.0.0: supported
+ Code referencing:
+ 18.0.0: supported
+ 17.14.13: supported
+ 17.14.6: supported
+ 17.14.0: supported
+ 17.13.0: supported
+ 0.0.0: not-supported
+ Copilot code review:
+ 18.0.0: supported
+ 17.14.13: supported
+ 17.14.6: supported
+ 17.14.0: supported
+ 17.13.0: supported
+ 0.0.0: supported
+ Custom instructions:
+ 18.0.0: supported
+ 17.14.13: supported
+ 17.14.6: supported
+ 17.14.0: supported
+ 17.13.0: supported
+ 0.0.0: supported
+ Edit mode:
+ 18.0.0: supported
+ 17.14.6: supported
+ 17.14.0: supported
+ 17.13.0: supported
+ 0.0.0: not-supported
+ Extensions:
+ 18.0.0: supported
+ 17.14.13: supported
+ 17.14.6: supported
+ 17.14.0: supported
+ 17.13.0: supported
+ 0.0.0: supported
+ Java Upgrade Agent:
+ 18.0.0: not-supported
+ 17.14.13: not-supported
+ 17.14.6: not-supported
+ 17.14.0: not-supported
+ 17.13.0: not-supported
+ 0.0.0: not-supported
+ MCP:
+ 18.0.0: supported
+ 17.14.13: supported
+ 17.14.6: preview
+ 17.14.0: preview
+ 17.13.0: not-supported
+ 0.0.0: not-supported
+ Next edit suggestions:
+ 18.0.0: supported
+ 17.14.13: supported
+ 17.14.6: supported
+ 17.14.0: supported
+ 17.13.0: not-supported
+ 0.0.0: not-supported
+ Prompt files:
+ 18.0.0: supported
+ 17.14.13: not-supported
+ 17.14.6: not-supported
+ 17.14.0: not-supported
+ 17.13.0: not-supported
+ 0.0.0: not-supported
+ Vision:
+ 18.0.0: preview
+ 17.14.13: preview
+ 17.14.6: preview
+ 17.14.0: preview
+ 17.13.0: preview
+ 0.0.0: preview
+ Workspace indexing:
+ 18.0.0: not-supported
+ 17.14.13: not-supported
+ 17.14.6: not-supported
+ 17.14.0: not-supported
+ 17.13.0: not-supported
+ 0.0.0: not-supported
+ JetBrains:
+ versions:
+ - 1.5.54
+ - 1.5.53
+ - 1.5.49
+ - 1.5.45
+ - 1.5.43
+ - 1.5.41
+ - 1.5.39
+ - 1.5.0
+ - 1.4.0
+ - 1.0.1
+ - 0.0.0
+ versionGroups:
+ latest releases:
+ - 1.5.54
+ - 1.5.53
+ - 1.5.49
+ - 1.5.45
+ - 1.5.43
+ 2025 releases:
+ - 1.5.54
+ - 1.5.53
+ - 1.5.49
+ - 1.5.45
+ - 1.5.43
+ - 1.5.41
+ - 1.5.0
+ - 1.0.1
+ 2024 releases:
+ - 1.5.39
+ - 1.4.0
+ features:
+ .NET Upgrade Agent:
+ 1.5.54: not-supported
+ 1.5.53: not-supported
+ 1.5.49: not-supported
+ 1.5.45: not-supported
+ 1.5.43: not-supported
+ 1.5.41: not-supported
+ 1.5.39: not-supported
+ 1.5.0: not-supported
+ 1.4.0: not-supported
+ 1.0.1: not-supported
+ 0.0.0: not-supported
+ Agent skills:
+ 1.5.54: not-supported
+ 1.5.53: not-supported
+ 1.5.49: not-supported
+ 1.5.45: not-supported
+ 1.5.43: not-supported
+ 1.5.41: not-supported
+ 1.5.39: not-supported
+ 1.5.0: not-supported
+ 1.4.0: not-supported
+ 1.0.1: not-supported
+ 0.0.0: not-supported
+ Agent mode:
+ 1.5.54: supported
+ 1.5.53: supported
+ 1.5.49: supported
+ 1.5.45: preview
+ 1.5.43: not-supported
+ 1.5.41: not-supported
+ 1.5.39: not-supported
+ 1.5.0: not-supported
+ 1.4.0: not-supported
+ 1.0.1: not-supported
+ 0.0.0: not-supported
+ BYOK:
+ 1.5.54: preview
+ 1.5.53: preview
+ 1.5.49: preview
+ 1.5.45: preview
+ 1.5.43: preview
+ 1.5.41: preview
+ 1.5.39: preview
+ 1.5.0: preview
+ 1.4.0: preview
+ 1.0.1: preview
+ 0.0.0: preview
+ Chat:
+ 1.5.54: supported
+ 1.5.53: supported
+ 1.5.49: supported
+ 1.5.45: supported
+ 1.5.43: supported
+ 1.5.41: supported
+ 1.5.39: supported
+ 1.5.0: supported
+ 1.4.0: preview
+ 1.0.1: not-supported
+ 0.0.0: not-supported
+ Checkpoints:
+ 1.5.54: not-supported
+ 1.5.53: not-supported
+ 1.5.49: not-supported
+ 1.5.45: not-supported
+ 1.5.43: not-supported
+ 1.5.41: not-supported
+ 1.5.39: not-supported
+ 1.5.0: not-supported
+ 1.4.0: not-supported
+ 1.0.1: not-supported
+ 0.0.0: not-supported
+ Code completion:
+ 1.5.54: supported
+ 1.5.53: supported
+ 1.5.49: supported
+ 1.5.45: supported
+ 1.5.43: supported
+ 1.5.41: supported
+ 1.5.39: supported
+ 1.5.0: supported
+ 1.4.0: supported
+ 1.0.1: supported
+ 0.0.0: preview
+ Code referencing:
+ 1.5.54: supported
+ 1.5.53: supported
+ 1.5.49: supported
+ 1.5.45: supported
+ 1.5.43: supported
+ 1.5.41: supported
+ 1.5.39: supported
+ 1.5.0: supported
+ 1.4.0: supported
+ 1.0.1: supported
+ 0.0.0: supported
+ Copilot code review:
+ 1.5.54: supported
+ 1.5.53: supported
+ 1.5.49: supported
+ 1.5.45: supported
+ 1.5.43: supported
+ 1.5.41: supported
+ 1.5.39: supported
+ 1.5.0: supported
+ 1.4.0: supported
+ 1.0.1: supported
+ 0.0.0: supported
+ Custom chat modes:
+ 1.5.54: not-supported
+ 1.5.53: not-supported
+ 1.5.49: not-supported
+ 1.5.45: not-supported
+ 1.5.43: not-supported
+ 1.5.41: not-supported
+ 1.5.39: not-supported
+ 1.5.0: not-supported
+ 1.4.0: not-supported
+ 1.0.1: not-supported
+ 0.0.0: not-supported
+ Custom instructions:
+ 1.5.54: preview
+ 1.5.53: preview
+ 1.5.49: preview
+ 1.5.45: preview
+ 1.5.43: preview
+ 1.5.41: preview
+ 1.5.39: not-supported
+ 1.5.0: not-supported
+ 1.4.0: not-supported
+ 1.0.1: not-supported
+ 0.0.0: not-supported
+ Edit mode:
+ 1.5.54: supported
+ 1.5.53: supported
+ 1.5.49: supported
+ 1.5.45: supported
+ 1.5.43: supported
+ 1.5.41: preview
+ 1.5.39: preview
+ 1.5.0: not-supported
+ 1.4.0: not-supported
+ 1.0.1: not-supported
+ 0.0.0: not-supported
+
+ Extensions:
+ 1.5.54: supported
+ 1.5.53: supported
+ 1.5.49: supported
+ 1.5.45: supported
+ 1.5.43: supported
+ 1.5.41: supported
+ 1.5.39: supported
+ 1.5.0: supported
+ 1.4.0: supported
+ 1.0.1: supported
+ 0.0.0: supported
+ Java Upgrade Agent:
+ 1.5.54: not-supported
+ 1.5.53: not-supported
+ 1.5.49: not-supported
+ 1.5.45: not-supported
+ 1.5.43: not-supported
+ 1.5.41: not-supported
+ 1.5.39: not-supported
+ 1.5.0: not-supported
+ 1.4.0: not-supported
+ 1.0.1: not-supported
+ 0.0.0: not-supported
+ MCP:
+ 0.0.0: not-supported
+ 1.0.1: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.5.39: not-supported
+ 1.5.41: not-supported
+ 1.5.43: not-supported
+ 1.5.45: preview
+ 1.5.49: preview
+ 1.5.53: supported
+ 1.5.54: supported
+ Next edit suggestions:
+ 1.5.54: preview
+ 1.5.53: not-supported
+ 1.5.49: not-supported
+ 1.5.45: not-supported
+ 1.5.43: not-supported
+ 1.5.41: not-supported
+ 1.5.39: not-supported
+ 1.5.0: not-supported
+ 1.4.0: not-supported
+ 1.0.1: not-supported
+ 0.0.0: not-supported
+ Prompt files:
+ 1.5.54: preview
+ 1.5.53: not-supported
+ 1.5.49: not-supported
+ 1.5.45: not-supported
+ 1.5.43: not-supported
+ 1.5.41: not-supported
+ 1.5.39: not-supported
+ 1.5.0: not-supported
+ 1.4.0: not-supported
+ 1.0.1: not-supported
+ 0.0.0: not-supported
+ Vision:
+ 1.5.54: preview
+ 1.5.53: preview
+ 1.5.49: preview
+ 1.5.45: preview
+ 1.5.43: preview
+ 1.5.41: preview
+ 1.5.39: not-supported
+ 1.5.0: not-supported
+ 1.4.0: not-supported
+ 1.0.1: not-supported
+ 0.0.0: not-supported
+ Workspace indexing:
+ 1.5.54: not-supported
+ 1.5.53: not-supported
+ 1.5.49: not-supported
+ 1.5.45: not-supported
+ 1.5.43: not-supported
+ 1.5.41: not-supported
+ 1.5.39: not-supported
+ 1.5.0: not-supported
+ 1.4.0: not-supported
+ 1.0.1: not-supported
+ 0.0.0: not-supported
+ Eclipse:
+ versions:
+ - 0.14.0
+ - 0.13.0
+ - 0.12.0
+ - 0.11.0
+ - 0.10.0
+ - 0.9.0
+ - 0.8.0
+ - 0.7.0
+ - 0.6.0
+ - 0.5.0
+ - 0.4.0
+ - 0.3.0
+ - 0.2.0
+ - 0.1.0
+ versionGroups:
+ latest releases:
+ - 0.14.0
+ - 0.13.0
+ - 0.12.0
+ - 0.11.0
+ - 0.10.0
+ 2025 releases:
+ - 0.14.0
+ - 0.13.0
+ - 0.12.0
+ - 0.11.0
+ - 0.10.0
+ - 0.9.0
+ - 0.8.0
+ - 0.7.0
+ - 0.6.0
+ - 0.5.0
+ - 0.4.0
+ - 0.3.0
+ - 0.2.0
+ - 0.1.0
+ features:
+ .NET Upgrade Agent:
+ 0.14.0: not-supported
+ 0.13.0: not-supported
+ 0.12.0: not-supported
+ 0.11.0: not-supported
+ 0.10.0: not-supported
+ 0.9.0: not-supported
+ 0.8.0: not-supported
+ 0.7.0: not-supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Agent skills:
+ 0.14.0: not-supported
+ 0.13.0: not-supported
+ 0.12.0: not-supported
+ 0.11.0: not-supported
+ 0.10.0: not-supported
+ 0.9.0: not-supported
+ 0.8.0: not-supported
+ 0.7.0: not-supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Agent mode:
+ 0.14.0: supported
+ 0.13.0: supported
+ 0.12.0: supported
+ 0.11.0: supported
+ 0.10.0: supported
+ 0.9.0: supported
+ 0.8.0: preview
+ 0.7.0: preview
+ 0.6.0: preview
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ BYOK:
+ 0.14.0: preview
+ 0.13.0: preview
+ 0.12.0: preview
+ 0.11.0: not-supported
+ 0.10.0: not-supported
+ 0.9.0: not-supported
+ 0.8.0: not-supported
+ 0.7.0: not-supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Chat:
+ 0.14.0: supported
+ 0.13.0: supported
+ 0.12.0: supported
+ 0.11.0: supported
+ 0.10.0: supported
+ 0.9.0: supported
+ 0.8.0: supported
+ 0.7.0: supported
+ 0.6.0: supported
+ 0.5.0: supported
+ 0.4.0: preview
+ 0.3.0: preview
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Checkpoints:
+ 0.14.0: not-supported
+ 0.13.0: not-supported
+ 0.12.0: not-supported
+ 0.11.0: not-supported
+ 0.10.0: not-supported
+ 0.9.0: not-supported
+ 0.8.0: not-supported
+ 0.7.0: not-supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Code completion:
+ 0.14.0: supported
+ 0.13.0: supported
+ 0.12.0: supported
+ 0.11.0: supported
+ 0.10.0: supported
+ 0.9.0: supported
+ 0.8.0: supported
+ 0.7.0: supported
+ 0.6.0: supported
+ 0.5.0: supported
+ 0.4.0: supported
+ 0.3.0: supported
+ 0.2.0: preview
+ 0.1.0: preview
+ Code referencing:
+ 0.14.0: supported
+ 0.13.0: supported
+ 0.12.0: supported
+ 0.11.0: supported
+ 0.10.0: supported
+ 0.9.0: supported
+ 0.8.0: supported
+ 0.7.0: supported
+ 0.6.0: supported
+ 0.5.0: supported
+ 0.4.0: supported
+ 0.3.0: supported
+ 0.2.0: supported
+ 0.1.0: supported
+ Copilot code review:
+ 0.14.0: not-supported
+ 0.13.0: not-supported
+ 0.12.0: not-supported
+ 0.11.0: not-supported
+ 0.10.0: not-supported
+ 0.9.0: not-supported
+ 0.8.0: not-supported
+ 0.7.0: not-supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Custom chat modes:
+ 0.14.0: supported
+ 0.13.0: supported
+ 0.12.0: not-supported
+ 0.11.0: not-supported
+ 0.10.0: not-supported
+ 0.9.0: not-supported
+ 0.8.0: not-supported
+ 0.7.0: not-supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Custom instructions:
+ 0.14.0: preview
+ 0.13.0: preview
+ 0.12.0: preview
+ 0.11.0: preview
+ 0.10.0: preview
+ 0.9.0: not-supported
+ 0.8.0: not-supported
+ 0.7.0: not-supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Edit mode:
+ 0.14.0: not-supported
+ 0.13.0: not-supported
+ 0.12.0: not-supported
+ 0.11.0: not-supported
+ 0.10.0: not-supported
+ 0.9.0: not-supported
+ 0.8.0: not-supported
+ 0.7.0: not-supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Extensions:
+ 0.14.0: not-supported
+ 0.13.0: not-supported
+ 0.12.0: not-supported
+ 0.11.0: not-supported
+ 0.10.0: not-supported
+ 0.9.0: not-supported
+ 0.8.0: not-supported
+ 0.7.0: not-supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Java Upgrade Agent:
+ 0.14.0: not-supported
+ 0.13.0: not-supported
+ 0.12.0: not-supported
+ 0.11.0: not-supported
+ 0.10.0: not-supported
+ 0.9.0: not-supported
+ 0.8.0: not-supported
+ 0.7.0: not-supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ MCP:
+ 0.14.0: supported
+ 0.13.0: supported
+ 0.12.0: supported
+ 0.11.0: supported
+ 0.10.0: supported
+ 0.9.0: preview
+ 0.8.0: preview
+ 0.7.0: preview
+ 0.6.0: preview
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Next edit suggestions:
+ 0.14.0: preview
+ 0.13.0: preview
+ 0.12.0: not-supported
+ 0.11.0: not-supported
+ 0.10.0: not-supported
+ 0.9.0: not-supported
+ 0.8.0: not-supported
+ 0.7.0: not-supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Prompt files:
+ 0.14.0: not-supported
+ 0.13.0: not-supported
+ 0.12.0: not-supported
+ 0.11.0: not-supported
+ 0.10.0: not-supported
+ 0.9.0: not-supported
+ 0.8.0: not-supported
+ 0.7.0: not-supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Vision:
+ 0.14.0: supported
+ 0.13.0: supported
+ 0.12.0: supported
+ 0.11.0: supported
+ 0.10.0: supported
+ 0.9.0: supported
+ 0.8.0: supported
+ 0.7.0: not-supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Workspace indexing:
+ 0.14.0: supported
+ 0.13.0: supported
+ 0.12.0: supported
+ 0.11.0: supported
+ 0.10.0: supported
+ 0.9.0: supported
+ 0.8.0: supported
+ 0.7.0: supported
+ 0.6.0: not-supported
+ 0.5.0: not-supported
+ 0.4.0: not-supported
+ 0.3.0: not-supported
+ 0.2.0: not-supported
+ 0.1.0: not-supported
+ Xcode:
+ versions:
+ - 0.46.0
+ - 0.45.0
+ - 0.44.0
+ - 0.43.0
+ - 0.42.0
+ - 0.41.0
+ - 0.40.0
+ - 0.39.0
+ - 0.38.0
+ - 0.37.0
+ - 0.36.0
+ - 0.35.0
+ - 0.34.0
+ - 0.33.0
+ - 0.32.0
+ - 0.31.0
+ - 0.30.0
+ - 0.29.0
+ - 0.28.0
+ - 0.27.0
+ - 0.26.0
+ - 0.25.0
+ - 0.24.0
+ - 0.23.0
+ - 0.0.0
+ versionGroups:
+ latest releases:
+ - 0.46.0
+ - 0.45.0
+ - 0.44.0
+ - 0.43.0
+ - 0.42.0
+ 2025 releases:
+ - 0.46.0
+ - 0.45.0
+ - 0.44.0
+ - 0.43.0
+ - 0.42.0
+ - 0.41.0
+ - 0.40.0
+ - 0.39.0
+ - 0.38.0
+ - 0.37.0
+ - 0.36.0
+ - 0.35.0
+ - 0.34.0
+ - 0.33.0
+ - 0.32.0
+ - 0.31.0
+ - 0.30.0
+ 2024 releases:
+ - 0.29.0
+ - 0.28.0
+ - 0.27.0
+ - 0.26.0
+ - 0.25.0
+ - 0.24.0
+ - 0.23.0
+ - 0.0.0
+ features:
+ .NET Upgrade Agent:
+ 0.46.0: not-supported
+ 0.45.0: not-supported
+ 0.44.0: not-supported
+ 0.43.0: not-supported
+ 0.42.0: not-supported
+ 0.41.0: not-supported
+ 0.40.0: not-supported
+ 0.39.0: not-supported
+ 0.38.0: not-supported
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Agent skills:
+ 0.46.0: not-supported
+ 0.45.0: not-supported
+ 0.44.0: not-supported
+ 0.43.0: not-supported
+ 0.42.0: not-supported
+ 0.41.0: not-supported
+ 0.40.0: not-supported
+ 0.39.0: not-supported
+ 0.38.0: not-supported
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Agent mode:
+ 0.46.0: supported
+ 0.45.0: supported
+ 0.44.0: supported
+ 0.43.0: supported
+ 0.42.0: supported
+ 0.41.0: supported
+ 0.40.0: supported
+ 0.39.0: supported
+ 0.38.0: supported
+ 0.37.0: preview
+ 0.36.0: preview
+ 0.35.0: preview
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ BYOK:
+ 0.46.0: preview
+ 0.45.0: preview
+ 0.44.0: preview
+ 0.43.0: preview
+ 0.42.0: preview
+ 0.41.0: not-supported
+ 0.40.0: not-supported
+ 0.39.0: not-supported
+ 0.38.0: not-supported
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Chat:
+ 0.46.0: supported
+ 0.45.0: supported
+ 0.44.0: supported
+ 0.43.0: supported
+ 0.42.0: supported
+ 0.41.0: supported
+ 0.40.0: supported
+ 0.39.0: supported
+ 0.38.0: supported
+ 0.37.0: supported
+ 0.36.0: supported
+ 0.35.0: supported
+ 0.34.0: supported
+ 0.33.0: supported
+ 0.32.0: supported
+ 0.31.0: preview
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Checkpoints:
+ 0.46.0: supported
+ 0.45.0: supported
+ 0.44.0: supported
+ 0.43.0: not-supported
+ 0.42.0: not-supported
+ 0.41.0: not-supported
+ 0.40.0: not-supported
+ 0.39.0: not-supported
+ 0.38.0: not-supported
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Code completion:
+ 0.46.0: supported
+ 0.45.0: supported
+ 0.44.0: supported
+ 0.43.0: supported
+ 0.42.0: supported
+ 0.41.0: supported
+ 0.40.0: supported
+ 0.39.0: supported
+ 0.38.0: supported
+ 0.37.0: supported
+ 0.36.0: supported
+ 0.35.0: supported
+ 0.34.0: supported
+ 0.33.0: supported
+ 0.32.0: supported
+ 0.31.0: supported
+ 0.30.0: preview
+ 0.29.0: preview
+ 0.28.0: preview
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Code referencing:
+ 0.46.0: not-supported
+ 0.45.0: not-supported
+ 0.44.0: not-supported
+ 0.43.0: not-supported
+ 0.42.0: not-supported
+ 0.41.0: not-supported
+ 0.40.0: not-supported
+ 0.39.0: not-supported
+ 0.38.0: not-supported
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Copilot code review:
+ 0.46.0: supported
+ 0.45.0: supported
+ 0.44.0: supported
+ 0.43.0: supported
+ 0.42.0: supported
+ 0.41.0: supported
+ 0.40.0: not-supported
+ 0.39.0: not-supported
+ 0.38.0: not-supported
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Custom chat modes:
+ 0.46.0: preview
+ 0.45.0: preview
+ 0.44.0: not-supported
+ 0.43.0: not-supported
+ 0.42.0: not-supported
+ 0.41.0: not-supported
+ 0.40.0: not-supported
+ 0.39.0: not-supported
+ 0.38.0: not-supported
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Custom instructions:
+ 0.46.0: preview
+ 0.45.0: preview
+ 0.44.0: preview
+ 0.43.0: preview
+ 0.42.0: preview
+ 0.41.0: preview
+ 0.40.0: preview
+ 0.39.0: preview
+ 0.38.0: preview
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Edit mode:
+ 0.46.0: not-supported
+ 0.45.0: not-supported
+ 0.44.0: not-supported
+ 0.43.0: not-supported
+ 0.42.0: not-supported
+ 0.41.0: not-supported
+ 0.40.0: not-supported
+ 0.39.0: not-supported
+ 0.38.0: not-supported
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Extensions:
+ 0.46.0: not-supported
+ 0.45.0: not-supported
+ 0.44.0: not-supported
+ 0.43.0: not-supported
+ 0.42.0: not-supported
+ 0.41.0: not-supported
+ 0.40.0: not-supported
+ 0.39.0: not-supported
+ 0.38.0: not-supported
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Java Upgrade Agent:
+ 0.46.0: not-supported
+ 0.45.0: not-supported
+ 0.44.0: not-supported
+ 0.43.0: not-supported
+ 0.42.0: not-supported
+ 0.41.0: not-supported
+ 0.40.0: not-supported
+ 0.39.0: not-supported
+ 0.38.0: not-supported
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ MCP:
+ 0.46.0: supported
+ 0.45.0: supported
+ 0.44.0: supported
+ 0.43.0: supported
+ 0.42.0: supported
+ 0.41.0: supported
+ 0.40.0: preview
+ 0.39.0: preview
+ 0.38.0: preview
+ 0.37.0: preview
+ 0.36.0: preview
+ 0.35.0: preview
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Next edit suggestions:
+ 0.46.0: preview
+ 0.45.0: preview
+ 0.44.0: not-supported
+ 0.43.0: not-supported
+ 0.42.0: not-supported
+ 0.41.0: not-supported
+ 0.40.0: not-supported
+ 0.39.0: not-supported
+ 0.38.0: not-supported
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Prompt files:
+ 0.46.0: preview
+ 0.45.0: preview
+ 0.44.0: preview
+ 0.43.0: preview
+ 0.42.0: preview
+ 0.41.0: not-supported
+ 0.40.0: not-supported
+ 0.39.0: not-supported
+ 0.38.0: not-supported
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Vision:
+ 0.46.0: preview
+ 0.45.0: preview
+ 0.44.0: preview
+ 0.43.0: preview
+ 0.42.0: preview
+ 0.41.0: preview
+ 0.40.0: preview
+ 0.39.0: preview
+ 0.38.0: preview
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ Workspace indexing:
+ 0.46.0: not-supported
+ 0.45.0: not-supported
+ 0.44.0: not-supported
+ 0.43.0: not-supported
+ 0.42.0: not-supported
+ 0.41.0: not-supported
+ 0.40.0: not-supported
+ 0.39.0: not-supported
+ 0.38.0: not-supported
+ 0.37.0: not-supported
+ 0.36.0: not-supported
+ 0.35.0: not-supported
+ 0.34.0: not-supported
+ 0.33.0: not-supported
+ 0.32.0: not-supported
+ 0.31.0: not-supported
+ 0.30.0: not-supported
+ 0.29.0: not-supported
+ 0.28.0: not-supported
+ 0.27.0: not-supported
+ 0.26.0: not-supported
+ 0.25.0: not-supported
+ 0.24.0: not-supported
+ 0.23.0: not-supported
+ 0.0.0: not-supported
+ NeoVim:
+ versions:
+ - 1.18.0
+ - 1.17.0
+ - 1.16.0
+ - 1.15.0
+ - 1.14.0
+ - 1.13.0
+ - 1.12.0
+ - 1.11.0
+ - 1.10.0
+ - 1.9.0
+ - 1.8.0
+ - 1.7.0
+ - 1.6.0
+ - 1.5.0
+ - 1.4.0
+ - 1.3.0
+ - 1.2.0
+ - 1.1.0
+ - 1.0.0
+ - 0.0.1
+ versionGroups:
+ latest releases:
+ - 1.18.0
+ - 1.17.0
+ - 1.16.0
+ - 1.15.0
+ - 1.14.0
+ 2024 releases:
+ - 1.18.0
+ - 1.17.0
+ - 1.16.0
+ - 1.15.0
+ - 1.14.0
+ 2023 releases:
+ - 1.13.0
+ - 1.12.0
+ - 1.11.0
+ - 1.10.0
+ - 1.9.0
+ 2022 releases:
+ - 1.8.0
+ - 1.7.0
+ - 1.6.0
+ - 1.5.0
+ - 1.4.0
+ - 1.3.0
+ - 1.2.0
+ - 1.1.0
+ 2021 releases:
+ - 1.0.0
+ - 0.0.1
+ features:
+ .NET Upgrade Agent:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Agent skills:
+ 1.18.0: not-supported
+ 1.17.0: not-supported
+ 1.16.0: not-supported
+ 1.15.0: not-supported
+ 1.14.0: not-supported
+ 1.13.0: not-supported
+ 1.12.0: not-supported
+ 1.11.0: not-supported
+ 1.10.0: not-supported
+ 1.9.0: not-supported
+ 1.8.0: not-supported
+ 1.7.0: not-supported
+ 1.6.0: not-supported
+ 1.5.0: not-supported
+ 1.4.0: not-supported
+ 1.3.0: not-supported
+ 1.2.0: not-supported
+ 1.1.0: not-supported
+ 1.0.0: not-supported
+ 0.0.1: not-supported
+ Agent mode:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ BYOK:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Chat:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Checkpoints:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Code completion:
+ 0.0.1: preview
+ 1.0.0: supported
+ 1.1.0: supported
+ 1.2.0: supported
+ 1.3.0: supported
+ 1.4.0: supported
+ 1.5.0: supported
+ 1.6.0: supported
+ 1.7.0: supported
+ 1.8.0: supported
+ 1.9.0: supported
+ 1.10.0: supported
+ 1.11.0: supported
+ 1.12.0: supported
+ 1.13.0: supported
+ 1.14.0: supported
+ 1.15.0: supported
+ 1.16.0: supported
+ 1.17.0: supported
+ 1.18.0: supported
+ Code referencing:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Copilot code review:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Custom chat modes:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Custom instructions:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Edit mode:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Extensions:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Java Upgrade Agent:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ MCP:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Next edit suggestions:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Prompt files:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Vision:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
+ Workspace indexing:
+ 0.0.1: not-supported
+ 1.0.0: not-supported
+ 1.1.0: not-supported
+ 1.2.0: not-supported
+ 1.3.0: not-supported
+ 1.4.0: not-supported
+ 1.5.0: not-supported
+ 1.6.0: not-supported
+ 1.7.0: not-supported
+ 1.8.0: not-supported
+ 1.9.0: not-supported
+ 1.10.0: not-supported
+ 1.11.0: not-supported
+ 1.12.0: not-supported
+ 1.13.0: not-supported
+ 1.14.0: not-supported
+ 1.15.0: not-supported
+ 1.16.0: not-supported
+ 1.17.0: not-supported
+ 1.18.0: not-supported
diff --git a/data/tables/copilot/model-comparison.yml b/data/tables/copilot/model-comparison.yml
new file mode 100644
index 000000000000..d3b81d6e78c0
--- /dev/null
+++ b/data/tables/copilot/model-comparison.yml
@@ -0,0 +1,117 @@
+# Please keep this list sorted in the following order:
+# 1. By provider, in this order:
+# - OpenAI
+# - Anthropic
+# - Google
+# - xAI
+# 2. Within each provider group, alphabetically by model name.
+
+# OpenAI
+- name: GPT-4.1
+ task_area: General-purpose coding and writing
+ excels_at: Fast, accurate code completions and explanations
+ further_reading: '[GPT-4.1 model card](https://openai.com/index/gpt-4-1/)'
+
+- name: GPT-5
+ task_area: Deep reasoning and debugging
+ excels_at: Multi-step problem solving and architecture-level code analysis
+ further_reading: '[GPT-5 model card](https://cdn.openai.com/gpt-5-system-card.pdf)'
+
+- name: GPT-5-Codex
+ task_area: General-purpose coding and writing
+ excels_at: Fast, accurate code completions and explanations
+ further_reading: '[GPT-5-Codex model card](https://cdn.openai.com/pdf/97cc5669-7a25-4e63-b15f-5fd5bdc4d149/gpt-5-codex-system-card.pdf)'
+
+- name: GPT-5 mini
+ task_area: General-purpose coding and writing
+ excels_at: Fast, accurate code completions and explanations
+ further_reading: '[GPT-5 mini model card](https://cdn.openai.com/gpt-5-system-card.pdf)'
+
+- name: GPT-5.1
+ task_area: Deep reasoning and debugging
+ excels_at: Multi-step problem solving and architecture-level code analysis
+ further_reading: '[GPT-5.1 model card](https://cdn.openai.com/pdf/4173ec8d-1229-47db-96de-06d87147e07e/5_1_system_card.pdf)'
+
+- name: GPT-5.1-Codex
+ task_area: Deep reasoning and debugging
+ excels_at: Multi-step problem solving and architecture-level code analysis
+ further_reading: 'Not available'
+
+- name: GPT-5.1 Codex Max
+ task_area: Agentic software development
+ excels_at: Agentic tasks
+ further_reading: '[GPT-5.1-Codex-Max model card](https://cdn.openai.com/pdf/2a7d98b1-57e5-4147-8d0e-683894d782ae/5p1_codex_max_card_03.pdf)'
+
+- name: GPT-5.1-Codex-Mini
+ task_area: Deep reasoning and debugging
+ excels_at: Multi-step problem solving and architecture-level code analysis
+ further_reading: 'Not available'
+
+- name: GPT-5.2
+ task_area: Deep reasoning and debugging
+ excels_at: Multi-step problem solving and architecture-level code analysis
+ further_reading: '[GPT-5.2 model card](https://cdn.openai.com/pdf/3a4153c8-c748-4b71-8e31-aecbde944f8d/oai_5_2_system-card.pdf)'
+
+- name: GPT-5.2-Codex
+ task_area: Agentic software development
+ excels_at: Agentic tasks
+ further_reading: '[GPT-5.2-Codex model card](https://cdn.openai.com/pdf/ac7c37ae-7f4c-4442-b741-2eabdeaf77e0/oai_5_2_Codex.pdf)'
+
+# Anthropic
+- name: Claude Haiku 4.5
+ task_area: Fast help with simple or repetitive tasks
+ excels_at: Fast, reliable answers to lightweight coding questions
+ further_reading: '[Claude Haiku 4.5 model card](https://assets.anthropic.com/m/99128ddd009bdcb/Claude-Haiku-4-5-System-Card.pdf)'
+
+- name: Claude Opus 4.1
+ task_area: Deep reasoning and debugging
+ excels_at: Complex problem-solving challenges, sophisticated reasoning
+ further_reading: '[Claude Opus 4.1 model card](https://assets.anthropic.com/m/4c024b86c698d3d4/original/Claude-4-1-System-Card.pdf)'
+
+- name: Claude Opus 4.5
+ task_area: Deep reasoning and debugging
+ excels_at: Complex problem-solving challenges, sophisticated reasoning
+ further_reading: '[Claude Opus 4.5 model card](https://assets.anthropic.com/m/64823ba7485345a7/Claude-Opus-4-5-System-Card.pdf)'
+
+- name: Claude Sonnet 4.0
+ task_area: Deep reasoning and debugging
+ excels_at: Performance and practicality, perfectly balanced for coding workflows
+ further_reading: '[Claude Sonnet 4.0 model card](https://www-cdn.anthropic.com/6be99a52cb68eb70eb9572b4cafad13df32ed995.pdf)'
+
+- name: Claude Sonnet 4.5
+ task_area: General-purpose coding and agent tasks
+ excels_at: Complex problem-solving challenges, sophisticated reasoning
+ further_reading: '[Claude Sonnet 4.5 model card](https://assets.anthropic.com/m/12f214efcc2f457a/original/Claude-Sonnet-4-5-System-Card.pdf)'
+
+# Google
+- name: Gemini 2.5 Pro
+ task_area: Deep reasoning and debugging
+ excels_at: Complex code generation, debugging, and research workflows
+ further_reading: '[Gemini 2.5 Pro model card](https://storage.googleapis.com/model-cards/documents/gemini-2.5-pro.pdf)'
+
+- name: Gemini 3 Flash
+ task_area: Fast help with simple or repetitive tasks
+ excels_at: Fast, reliable answers to lightweight coding questions
+ further_reading: '[Gemini 3 Flash model card](https://storage.googleapis.com/deepmind-media/Model-Cards/Gemini-3-Flash-Model-Card.pdf)'
+
+- name: Gemini 3 Pro
+ task_area: Deep reasoning and debugging
+ excels_at: Complex code generation, debugging, and research workflows
+ further_reading: '[Gemini 3 Pro model card](https://storage.googleapis.com/deepmind-media/Model-Cards/Gemini-3-Pro-Model-Card.pdf)'
+
+# xAI
+- name: Grok Code Fast 1
+ task_area: General-purpose coding and writing
+ excels_at: Fast, accurate code completions and explanations
+ further_reading: '[Grok Code Fast 1 model card](https://data.x.ai/2025-08-20-grok-4-model-card.pdf)'
+
+# Other providers (alphabetized by model name)
+- name: Qwen2.5
+ task_area: General-purpose coding and writing
+ excels_at: Code generation, reasoning, and code repair / debugging
+ further_reading: '[Qwen2.5 model card](https://arxiv.org/pdf/2409.12186)'
+
+- name: Raptor mini
+ task_area: General-purpose coding and writing
+ excels_at: Fast, accurate code completions and explanations
+ further_reading: 'Coming soon'
diff --git a/data/tables/copilot/model-deprecation-history.yml b/data/tables/copilot/model-deprecation-history.yml
index b97d7b5d9887..951da69e1afd 100644
--- a/data/tables/copilot/model-deprecation-history.yml
+++ b/data/tables/copilot/model-deprecation-history.yml
@@ -11,6 +11,18 @@
# - retirement_date: The official retirement date for the model (YYYY-MM-DD).
# - suggested_alternative: The model recommended for migration.
+- name: 'Claude Opus 4.1'
+ retirement_date: '2026-02-17'
+ suggested_alternative: 'Claude Opus 4.5'
+
+- name: 'GPT-5'
+ retirement_date: '2026-02-17'
+ suggested_alternative: 'GPT-5.2'
+
+- name: 'GPT-5-Codex'
+ retirement_date: '2026-02-17'
+ suggested_alternative: 'GPT-5.1-Codex'
+
- name: 'Claude Sonnet 3.5'
retirement_date: '2025-11-06'
suggested_alternative: 'Claude Haiku 4.5'
diff --git a/data/tables/copilot/model-multipliers.yml b/data/tables/copilot/model-multipliers.yml
index 10ce00d0ad46..b68d7cdeb928 100644
--- a/data/tables/copilot/model-multipliers.yml
+++ b/data/tables/copilot/model-multipliers.yml
@@ -17,6 +17,10 @@
multiplier_paid: 10
multiplier_free: Not applicable
+- name: Claude Opus 4.5
+ multiplier_paid: 3
+ multiplier_free: Not applicable
+
- name: Claude Sonnet 4
multiplier_paid: 1
multiplier_free: Not applicable
@@ -29,6 +33,10 @@
multiplier_paid: 1
multiplier_free: Not applicable
+- name: Gemini 3 Flash
+ multiplier_paid: 0.33
+ multiplier_free: Not applicable
+
- name: Gemini 3 Pro
multiplier_paid: 1
multiplier_free: Not applicable
@@ -65,6 +73,18 @@
multiplier_paid: 0.33
multiplier_free: Not applicable
+- name: GPT-5.1-Codex-Max
+ multiplier_paid: 1.0
+ multiplier_free: Not applicable
+
+- name: GPT-5.2
+ multiplier_paid: 1.0
+ multiplier_free: Not applicable
+
+- name: GPT-5.2-Codex
+ multiplier_paid: 1.0
+ multiplier_free: Not applicable
+
- name: Grok Code Fast 1
multiplier_paid: 0.25
multiplier_free: Not applicable
diff --git a/data/tables/copilot/model-release-status.yml b/data/tables/copilot/model-release-status.yml
index 78ef028992e9..534181ad9227 100644
--- a/data/tables/copilot/model-release-status.yml
+++ b/data/tables/copilot/model-release-status.yml
@@ -27,7 +27,7 @@
- name: 'GPT-5'
provider: 'OpenAI'
- release_status: 'GA'
+ release_status: 'Closing down: 2026-02-17'
agent_mode: true
ask_mode: true
edit_mode: true
@@ -41,21 +41,21 @@
- name: 'GPT-5-Codex'
provider: 'OpenAI'
- release_status: 'Public preview'
+ release_status: 'Closing down: 2026-02-17'
agent_mode: true
ask_mode: true
edit_mode: true
- name: 'GPT-5.1'
provider: 'OpenAI'
- release_status: 'Public preview'
+ release_status: 'GA'
agent_mode: true
ask_mode: true
edit_mode: true
- name: 'GPT-5.1-Codex'
provider: 'OpenAI'
- release_status: 'Public preview'
+ release_status: 'GA'
agent_mode: true
ask_mode: true
edit_mode: true
@@ -67,6 +67,27 @@
ask_mode: true
edit_mode: true
+- name: 'GPT-5.1-Codex-Max'
+ provider: 'OpenAI'
+ release_status: 'GA'
+ agent_mode: true
+ ask_mode: true
+ edit_mode: true
+
+- name: 'GPT-5.2'
+ provider: 'OpenAI'
+ release_status: 'GA'
+ agent_mode: true
+ ask_mode: true
+ edit_mode: true
+
+- name: 'GPT-5.2-Codex'
+ provider: 'OpenAI'
+ release_status: 'GA'
+ agent_mode: true
+ ask_mode: true
+ edit_mode: true
+
# Anthropic models
- name: 'Claude Haiku 4.5'
provider: 'Anthropic'
@@ -77,11 +98,18 @@
- name: 'Claude Opus 4.1'
provider: 'Anthropic'
- release_status: 'GA'
+ release_status: 'Closing down: 2026-02-17'
agent_mode: false
ask_mode: true
edit_mode: true
+- name: 'Claude Opus 4.5'
+ provider: 'Anthropic'
+ release_status: 'GA'
+ agent_mode: true
+ ask_mode: true
+ edit_mode: true
+
- name: 'Claude Sonnet 4'
provider: 'Anthropic'
release_status: 'GA'
@@ -105,6 +133,13 @@
ask_mode: true
edit_mode: true
+- name: 'Gemini 3 Flash'
+ provider: 'Google'
+ release_status: 'Public preview'
+ agent_mode: true
+ ask_mode: true
+ edit_mode: true
+
- name: 'Gemini 3 Pro'
provider: 'Google'
release_status: 'Public preview'
diff --git a/data/tables/copilot/model-supported-clients.yml b/data/tables/copilot/model-supported-clients.yml
index 151dc7bcc116..906aba040a31 100644
--- a/data/tables/copilot/model-supported-clients.yml
+++ b/data/tables/copilot/model-supported-clients.yml
@@ -29,6 +29,14 @@
xcode: true
jetbrains: true
+- name: Claude Opus 4.5
+ dotcom: true
+ vscode: true
+ vs: true
+ eclipse: true
+ xcode: true
+ jetbrains: true
+
- name: Claude Sonnet 4
dotcom: true
vscode: true
@@ -53,13 +61,21 @@
xcode: true
jetbrains: true
+- name: Gemini 3 Flash
+ dotcom: true
+ vscode: true
+ vs: true
+ eclipse: true
+ xcode: true
+ jetbrains: true
+
- name: Gemini 3 Pro
dotcom: true
vscode: true
- vs: false
- eclipse: false
- xcode: false
- jetbrains: false
+ vs: true
+ eclipse: true
+ xcode: true
+ jetbrains: true
- name: GPT-4.1
dotcom: true
@@ -96,7 +112,7 @@
- name: GPT-5.1
dotcom: true
vscode: true
- vs: false
+ vs: true
eclipse: true
xcode: true
jetbrains: true
@@ -117,6 +133,30 @@
xcode: true
jetbrains: true
+- name: GPT-5.1-Codex-Max
+ dotcom: true
+ vscode: true
+ vs: true
+ eclipse: true
+ xcode: true
+ jetbrains: true
+
+- name: GPT-5.2
+ dotcom: true
+ vscode: true
+ vs: true
+ eclipse: true
+ xcode: true
+ jetbrains: true
+
+- name: GPT-5.2-Codex
+ dotcom: true
+ vscode: true
+ vs: true
+ eclipse: true
+ xcode: true
+ jetbrains: true
+
- name: Grok Code Fast 1
dotcom: true
vscode: true
diff --git a/data/tables/copilot/model-supported-plans.yml b/data/tables/copilot/model-supported-plans.yml
index 63d94d9f89dd..a7c16376a56b 100644
--- a/data/tables/copilot/model-supported-plans.yml
+++ b/data/tables/copilot/model-supported-plans.yml
@@ -26,6 +26,13 @@
business: false
enterprise: true
+- name: Claude Opus 4.5
+ free: false
+ pro: true
+ pro_plus: true
+ business: true
+ enterprise: true
+
- name: Claude Sonnet 4
free: false
pro: true
@@ -47,6 +54,13 @@
business: true
enterprise: true
+- name: Gemini 3 Flash
+ free: false
+ pro: true
+ pro_plus: true
+ business: true
+ enterprise: true
+
- name: Gemini 3 Pro
free: false
pro: true
@@ -103,6 +117,27 @@
business: true
enterprise: true
+- name: GPT-5.1-Codex-Max
+ free: false
+ pro: true
+ pro_plus: true
+ business: true
+ enterprise: true
+
+- name: GPT-5.2
+ free: false
+ pro: true
+ pro_plus: true
+ business: true
+ enterprise: true
+
+- name: GPT-5.2-Codex
+ free: false
+ pro: true
+ pro_plus: true
+ business: true
+ enterprise: true
+
- name: Grok Code Fast 1
free: false
pro: true
diff --git a/data/ui.yml b/data/ui.yml
index 1e3986a0f4ec..1f6257f545fe 100644
--- a/data/ui.yml
+++ b/data/ui.yml
@@ -98,6 +98,7 @@ pages:
about_versions: About versions
permissions_callout_title: Who can use this feature?
video_from_transcript: See video for this transcript
+ view_page_as_markdown: View page as Markdown
support:
still_need_help: Still need help?
contact_support: Contact support
@@ -258,6 +259,7 @@ footer:
machine: Some of this content may be machine- or AI-translated.
journey_landing:
articles: '{{ number }} Articles'
+ articles_heading: Articles
product_landing:
article_grid:
heading: Articles
@@ -344,6 +346,9 @@ cookbook_landing:
category: Category
complexity: Complexity
+carousels:
+ recommended: Recommended
+
not_found:
title: Ooops!
message: It looks like this page doesn't exist.
diff --git a/data/variables/contact.yml b/data/variables/contact.yml
index b14d68771f94..39c32bb825ec 100644
--- a/data/variables/contact.yml
+++ b/data/variables/contact.yml
@@ -43,3 +43,6 @@ contact_landing_page_portal: '[GitHub Support portal](https://support.github.com
# GitHub Community discussions
community_support_forum: '[GitHub Community discussions](https://github.com/orgs/community/discussions)'
community_feedback_discussions: 'GitHub Community discussions'
+
+# Special Events Support
+special_events_support: 'Special Events Support'
diff --git a/data/variables/copilot.yml b/data/variables/copilot.yml
index 07fd47e4c8f5..c925e34e78e7 100644
--- a/data/variables/copilot.yml
+++ b/data/variables/copilot.yml
@@ -119,6 +119,7 @@ copilot_extensibility_platform_short: 'Copilot Extensibility Platform'
copilot_extensibility_platform: 'GitHub Copilot Extensibility Platform'
copilot_for_prs: 'Copilot pull request summaries'
copilot_prs_short: 'pull request summaries'
+copilot_memory: 'Copilot Memory'
copilot_in_support: 'Copilot in GitHub Support'
copilot_preview_features: 'Copilot preview features'
copilot_sku_isolation: 'Copilot subscription-based network routing'
@@ -138,6 +139,7 @@ copilot_claude: 'Claude'
copilot_claude_haiku_45: 'Claude Haiku 4.5'
copilot_claude_opus: 'Claude Opus 4'
copilot_claude_opus_41: 'Claude Opus 4.1'
+copilot_claude_opus_45: 'Claude Opus 4.5'
copilot_claude_sonnet: 'Claude Sonnet'
copilot_claude_sonnet_35: 'Claude Sonnet 3.5'
copilot_claude_sonnet_37: 'Claude Sonnet 3.7'
@@ -146,6 +148,7 @@ copilot_claude_sonnet_45: 'Claude Sonnet 4.5'
# Gemini:
copilot_gemini: 'Gemini'
copilot_gemini_flash: 'Gemini 2.0 Flash'
+copilot_gemini_3_flash: 'Gemini 3 Flash'
copilot_gemini_25_pro: 'Gemini 2.5 Pro'
copilot_gemini_3_pro: 'Gemini 3 Pro'
# OpenAI GPT series:
@@ -157,6 +160,9 @@ copilot_gpt_5_mini: 'GPT-5 mini'
copilot_gpt_51: 'GPT-5.1'
copilot_gpt_51_codex: 'GPT-5.1-Codex'
copilot_gpt_51_codex_mini: 'GPT-5.1-Codex-Mini'
+copilot_gpt_51_codex_max: 'GPT-5.1-Codex-Max'
+copilot_gpt_52: 'GPT-5.2'
+copilot_gpt_52_codex: 'GPT-5.2-Codex'
# OpenAI 'o' series:
copilot_o3: 'o3'
copilot_o4_mini: 'o4-mini'
diff --git a/data/variables/product.yml b/data/variables/product.yml
index 4992cab13386..d8559892ceed 100644
--- a/data/variables/product.yml
+++ b/data/variables/product.yml
@@ -96,7 +96,7 @@ prodname_codeql_cli: 'CodeQL CLI'
# CodeQL usually bumps its minor version for each minor version of GHES.
# Update this whenever a new enterprise version of CodeQL is being prepared.
codeql_cli_ghes_recommended_version: >-
- {% ifversion ghes < 3.15 %}2.17.6{% elsif ghes < 3.16 %}2.18.4{% elsif ghes < 3.17 %}2.20.3{% elsif ghes < 3.18 %}2.20.7{% elsif ghes < 3.19 %}2.21.4{% endif %}
+ {% ifversion ghes < 3.15 %}2.17.6{% elsif ghes < 3.16 %}2.18.4{% elsif ghes < 3.17 %}2.20.3{% elsif ghes < 3.18 %}2.20.7{% elsif ghes < 3.19 %}2.21.4{% elsif ghes < 3.20 %}2.22.4{% endif %}
codeql_cli_version_min_version_create_bundle: '2.17.6'
# Projects v2
prodname_projects_v2: 'Projects'
@@ -149,7 +149,7 @@ prodname_unfurls: 'Content Attachments'
prodname_actions: 'GitHub Actions'
prodname_actions_runner_controller: 'Actions Runner Controller'
runner_required_version: >-
- {% ifversion ghes < 3.15 %}2.317.0{% elsif ghes < 3.16 %}2.319.1{% elsif ghes < 3.17 %}2.321.0{% elsif ghes < 3.18 %}2.322.0{% elsif ghes < 3.19 %}2.324.0{% endif %}
+ {% ifversion ghes < 3.15 %}2.317.0{% elsif ghes < 3.16 %}2.319.1{% elsif ghes < 3.17 %}2.321.0{% elsif ghes < 3.18 %}2.322.0{% elsif ghes < 3.19 %}2.324.0{% elsif ghes < 3.20 %}2.328.0{% endif %}
# GitHub Debug
prodname_debug: 'GitHub Debug'
@@ -173,6 +173,7 @@ prodname_container_registries: 'Container registries'
prodname_docker_registry_namespace: '{% ifversion fpt or ghec %}`docker.pkg.github.com`{% elsif ghes %}docker.HOSTNAME{% endif %}'
prodname_container_registry_namespace: '{% ifversion fpt or ghec %}`ghcr.io`{% elsif ghes %}containers.HOSTNAME{% endif %}'
prodname_npm_registry: 'npm registry'
+virtual_registry: 'linked artifacts page'
# GitHub Insights
prodname_insights: 'GitHub Insights'
@@ -248,8 +249,8 @@ prodname_roadmap_link: 'https://github.com/github/roadmap#github-public-roadmap'
# GitHub Support plans
standard_support_plan: 'Standard plan'
premium_support_plan: 'Premium plan'
-premium_plus_support_plan: 'Premium Plus plan / GitHub Engineering Direct'
-microsoft_premium_plus_support_plan: 'GitHub Engineering Direct'
+premium_plus_support_plan: 'Premium Plus plan'
+microsoft_premium_plus_support_plan: 'Mission Critical Services for GitHub plan'
support_ticket_priority_urgent: 'Urgent'
support_ticket_priority_high: 'High'
support_ticket_priority_normal: 'Normal'
diff --git a/data/variables/secret-scanning.yml b/data/variables/secret-scanning.yml
index 294a25693c23..49175ea71921 100644
--- a/data/variables/secret-scanning.yml
+++ b/data/variables/secret-scanning.yml
@@ -17,7 +17,7 @@ roi-calculator: 'ROI calculator'
pricing-calculator: 'pricing calculator'
# Secret risk assessment call to action links. If changing the links below, also update the hard-coded link in /code-security/index.md
-secret-risk-assessment-cta-link: '/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/viewing-the-secret-risk-assessment-report-for-your-organization#generating-an-initial-secret-risk-assessment'
+secret-risk-assessment-cta-link: '/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/assess-your-secret-risk'
secret-risk-assessment-cta-text: 'Find out how to run a free secret risk assessment'
secret-risk-assessment-cta-product: '[{% data variables.secret-scanning.secret-risk-assessment-cta-text %}](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/viewing-the-secret-risk-assessment-report-for-your-organization#generating-an-initial-secret-risk-assessment)'
diff --git a/empty.ts b/empty.ts
index 4e0a2c5f275b..57ea2e90587f 100644
--- a/empty.ts
+++ b/empty.ts
@@ -1,3 +1,12 @@
// Empty module to satisfy Turbopack resolveAlias fallback for Node.js modules
// See turbopack config in next.config.ts
+
+// No-op function that returns itself for chaining
+export const createLogger = () => ({
+ info: () => {},
+ warn: () => {},
+ error: () => {},
+ debug: () => {},
+})
+
export default {}
diff --git a/eslint.config.ts b/eslint.config.ts
index ad1d60c95db7..ecb8ae8abd3d 100644
--- a/eslint.config.ts
+++ b/eslint.config.ts
@@ -12,6 +12,7 @@ import noOnlyTests from 'eslint-plugin-no-only-tests'
import prettierPlugin from 'eslint-plugin-prettier'
import prettier from 'eslint-config-prettier'
import globals from 'globals'
+import customRules from 'eslint-plugin-custom-rules'
export default [
{
@@ -57,6 +58,7 @@ export default [
'@typescript-eslint': tseslint,
'primer-react': primerReact,
'jsx-a11y': jsxA11y,
+ 'custom-rules': customRules,
},
rules: {
// ESLint recommended rules
@@ -97,18 +99,92 @@ export default [
// Disabled rules to review
'no-console': 'off', // 800+
- '@typescript-eslint/no-explicit-any': 'off', // 1000+
+ '@typescript-eslint/no-explicit-any': 'off',
+
+ // Custom rules (disabled by default for now)
+ 'custom-rules/use-custom-logger': 'off',
+ },
+ },
+
+ // Configuration for eslint-rules directory (CommonJS JavaScript files)
+ {
+ files: ['src/eslint-rules/**/*.js'],
+ languageOptions: {
+ ecmaVersion: 2022,
+ sourceType: 'script',
+ globals: {
+ ...globals.node,
+ ...globals.commonjs,
+ ...globals.es2020,
+ },
+ },
+ plugins: {
+ github,
+ import: importPlugin,
+ 'eslint-comments': eslintComments,
+ filenames,
+ 'no-only-tests': noOnlyTests,
+ prettier: prettierPlugin,
+ },
+ rules: {
+ // ESLint recommended rules
+ ...js.configs.recommended.rules,
+
+ // GitHub plugin recommended rules
+ ...github.configs.recommended.rules,
+
+ // Import plugin error rules
+ ...importPlugin.configs.errors.rules,
+
+ // Allow CommonJS in eslint rules
+ 'import/no-commonjs': 'off',
+
+ // Overrides
+ 'import/extensions': ['error', { json: 'always' }],
+ 'no-empty': ['error', { allowEmptyCatch: true }],
+ 'prefer-const': ['error', { destructuring: 'all' }],
+
+ // Disabled rules
+ 'i18n-text/no-en': 'off',
+ 'filenames/match-regex': 'off',
+ camelcase: 'off',
+ 'no-console': 'off',
+ },
+ },
+
+ // Disable custom logger rule for logger implementation itself
+ {
+ files: ['src/observability/logger/**/*.{ts,js}'],
+ rules: {
+ 'custom-rules/use-custom-logger': 'off',
+ },
+ },
+
+ // Override for scripts, tests, workflows, content-linter, and React files (disable custom logger rule)
+ {
+ files: [
+ '**/scripts/**/*.{ts,js}',
+ '**/tests/**/*.{ts,js}',
+ 'src/workflows/**/*.{ts,js}',
+ 'src/content-linter/**/*.{ts,js}',
+ '**/*.{tsx,jsx}',
+ ],
+ rules: {
+ 'custom-rules/use-custom-logger': 'off',
},
},
// Ignored patterns
+ // CodeQL scripts included because cocofix is install manually by the workflow
{
ignores: [
'tmp/*',
'.next/',
'rest-api-description/',
'docs-internal-data/',
- 'src/code-scanning/scripts/generate-code-scanning-query-list.ts',
+ 'src/codeql-queries/scripts/generate-code-scanning-query-list.ts',
+ 'src/codeql-queries/scripts/generate-code-quality-query-list.ts',
+ 'next-env.d.ts',
],
},
diff --git a/next.config.ts b/next.config.ts
index b3106dd10c1a..9cb550450c21 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -37,7 +37,7 @@ const config: NextConfig = {
},
// Don't use automatic Next.js logging in dev unless the log level is `debug` or higher
// See `src/observability/logger/README.md` for log levels
- logging: getLogLevelNumber() < 3 ? false : {},
+ logging: getLogLevelNumber() < 3 ? undefined : {},
async rewrites() {
const DEFAULT_VERSION = 'free-pro-team@latest'
return productIds.map((productId) => {
@@ -48,6 +48,11 @@ const config: NextConfig = {
})
},
+ webpack: (webpackConfig) => {
+ webpackConfig.resolve.fallback = { fs: false, async_hooks: false }
+ return webpackConfig
+ },
+
// Turbopack is the default bundler in Next.js 16
// Keep webpack config for now to support both bundlers
@@ -60,16 +65,15 @@ const config: NextConfig = {
async_hooks: {
browser: './empty.ts', // Point to empty module when async_hooks is requested for browser
},
+ '@/observability/logger': {
+ browser: './empty.ts',
+ },
+ '@/observability/logger/lib/logger-context': {
+ browser: './empty.ts',
+ },
},
},
- webpack: (webpackConfig) => {
- webpackConfig.experiments = webpackConfig.experiments || {}
- webpackConfig.experiments.topLevelAwait = true
- webpackConfig.resolve.fallback = { fs: false, async_hooks: false }
- return webpackConfig
- },
-
// https://nextjs.org/docs/api-reference/next.config.js/compression
compress: false,
@@ -79,18 +83,6 @@ const config: NextConfig = {
// the CDN marks the cached content as "fresh".
generateEtags: false,
- experimental: {
- // The output of our getServerSideProps() return large chunks of
- // data because it contains our rendered Markdown.
- // The default, for a "Large Page Data" warning is 128KB
- // but many of our pages are much larger.
- // The warning is: https://nextjs.org/docs/messages/large-page-data
- largePageDataBytes: 1024 * 1024, // 1 MB
-
- // This makes it so that going Back will scroll to the previous position
- scrollRestoration: true,
- },
-
compiler: {
styledComponents: true,
},
diff --git a/package-lock.json b/package-lock.json
index 147d6035613c..adb77ee3929b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5,13 +5,14 @@
"packages": {
"": {
"name": "docs.github.com",
- "hasInstallScript": true,
"license": "(MIT AND CC-BY-4.0)",
"dependencies": {
- "@elastic/elasticsearch": "8.13.1",
+ "@elastic/elasticsearch": "8.19.1",
"@github/failbot": "0.8.3",
+ "@github/hydro-analytics-client": "^2.3.3",
"@gr2m/gray-matter": "4.0.3-with-pr-137",
"@horizon-rs/language-guesser": "0.1.1",
+ "@octokit/graphql": "9.0.1",
"@octokit/plugin-retry": "8.0.1",
"@octokit/request-error": "7.0.0",
"@primer/behaviors": "^1.7.2",
@@ -19,6 +20,7 @@
"@primer/live-region-element": "^0.7.2",
"@primer/octicons": "^19.19.0",
"@primer/octicons-react": "^19.14.0",
+ "@primer/primitives": "^11.3.1",
"@primer/react": "^38.0.0",
"accept-language-parser": "^1.5.0",
"ajv": "^8.17.1",
@@ -38,37 +40,37 @@
"dereference-json-schema": "^0.2.1",
"dotenv": "^17.0.1",
"escape-string-regexp": "5.0.0",
- "express": "^5.1.0",
+ "express": "^5.2.0",
"fastest-levenshtein": "1.0.16",
"file-type": "21.0.0",
"flat": "^6.0.1",
"github-slugger": "^2.0.0",
- "glob": "11.0.2",
+ "glob": "11.1.0",
"hast-util-from-parse5": "^8.0.3",
"hast-util-to-string": "^3.0.1",
"hastscript": "^9.0.1",
"helmet": "^8.0.0",
"highlight.js": "^11.11.1",
"highlightjs-curl": "^1.3.0",
- "hot-shots": "^11.1.0",
+ "hot-shots": "^13.1.0",
"html-entities": "^2.5.6",
"http-proxy-middleware": "^3.0.5",
"imurmurhash": "^0.1.4",
"is-svg": "6.0.0",
"javascript-stringify": "^2.1.0",
"js-cookie": "^3.0.5",
- "js-yaml": "^4.1.0",
+ "js-yaml": "^4.1.1",
"liquidjs": "^10.16.7",
- "lodash": "^4.17.21",
- "lodash-es": "^4.17.21",
+ "lodash": "^4.17.23",
+ "lodash-es": "^4.17.23",
"lowdb": "7.0.1",
"lowlight": "^3.3.0",
"markdownlint-rule-helpers": "^0.25.0",
"mdast-util-from-markdown": "^2.0.2",
- "mdast-util-to-hast": "^13.2.0",
+ "mdast-util-to-hast": "^13.2.1",
"mdast-util-to-markdown": "2.1.2",
"mdast-util-to-string": "^4.0.0",
- "next": "^16.0.1",
+ "next": "^16.1.5",
"ora": "^9.0.0",
"parse5": "7.1.2",
"quick-lru": "7.0.1",
@@ -102,12 +104,12 @@
"walk-sync": "^4.0.1"
},
"devDependencies": {
- "@actions/core": "^1.10.1",
- "@actions/github": "^6.0.0",
+ "@actions/core": "^2.0.0",
+ "@actions/github": "^8.0.1",
"@axe-core/playwright": "^4.10.1",
"@eslint/js": "^9.33.0",
"@github/markdownlint-github": "^0.6.3",
- "@graphql-inspector/core": "^6.1.0",
+ "@graphql-inspector/core": "^7.0.3",
"@graphql-tools/load": "^8.0.19",
"@octokit/rest": "22.0.0",
"@playwright/test": "^1.56",
@@ -142,6 +144,7 @@
"eslint": "^9.33.0",
"eslint-config-prettier": "^10.1.8",
"eslint-import-resolver-typescript": "^4.4.2",
+ "eslint-plugin-custom-rules": "file:src/eslint-rules",
"eslint-plugin-escompat": "^3.11.4",
"eslint-plugin-eslint-comments": "^3.2.0",
"eslint-plugin-filenames": "^1.3.2",
@@ -153,7 +156,7 @@
"eslint-plugin-prettier": "^5.5.4",
"eslint-plugin-primer-react": "^8.0.0",
"event-to-promise": "^0.8.0",
- "globals": "^16.3.0",
+ "globals": "^17.0.0",
"graphql": "^16.9.0",
"http-status-code": "^2.1.0",
"husky": "^9.1.7",
@@ -195,14 +198,14 @@
}
},
"node_modules/@actions/core": {
- "version": "1.11.1",
- "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
- "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.0.tgz",
+ "integrity": "sha512-iGW52/zqhPUFnYl0s1ioXfJu86LGs7b+GYuO38JMPpsh14FQrNj3n2JBpC+vZ2CFS4lERQyn5koLDopY+6V/PQ==",
"dev": true,
"license": "MIT",
"dependencies": {
"@actions/exec": "^1.1.1",
- "@actions/http-client": "^2.0.1"
+ "@actions/http-client": "^3.0.0"
}
},
"node_modules/@actions/exec": {
@@ -216,178 +219,75 @@
}
},
"node_modules/@actions/github": {
- "version": "6.0.0",
- "resolved": "https://registry.npmjs.org/@actions/github/-/github-6.0.0.tgz",
- "integrity": "sha512-alScpSVnYmjNEXboZjarjukQEzgCRmjMv6Xj47fsdnqGS73bjJNDpiiXmp8jr0UZLdUB6d9jW63IcmddUP+l0g==",
- "dev": true,
- "dependencies": {
- "@actions/http-client": "^2.2.0",
- "@octokit/core": "^5.0.1",
- "@octokit/plugin-paginate-rest": "^9.0.0",
- "@octokit/plugin-rest-endpoint-methods": "^10.0.0"
- }
- },
- "node_modules/@actions/github/node_modules/@octokit/auth-token": {
- "version": "4.0.0",
- "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-4.0.0.tgz",
- "integrity": "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA==",
- "dev": true,
- "engines": {
- "node": ">= 18"
- }
- },
- "node_modules/@actions/github/node_modules/@octokit/core": {
- "version": "5.2.0",
- "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.0.tgz",
- "integrity": "sha512-1LFfa/qnMQvEOAdzlQymH0ulepxbxnCYAKJZfMci/5XJyIHWgEYnDmgnKakbTh7CH2tFQ5O60oYDvns4i9RAIg==",
- "dev": true,
- "dependencies": {
- "@octokit/auth-token": "^4.0.0",
- "@octokit/graphql": "^7.1.0",
- "@octokit/request": "^8.3.1",
- "@octokit/request-error": "^5.1.0",
- "@octokit/types": "^13.0.0",
- "before-after-hook": "^2.2.0",
- "universal-user-agent": "^6.0.0"
- },
- "engines": {
- "node": ">= 18"
- }
- },
- "node_modules/@actions/github/node_modules/@octokit/endpoint": {
- "version": "9.0.6",
- "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.6.tgz",
- "integrity": "sha512-H1fNTMA57HbkFESSt3Y9+FBICv+0jFceJFPWDePYlR/iMGrwM5ph+Dd4XRQs+8X+PUFURLQgX9ChPfhJ/1uNQw==",
+ "version": "8.0.1",
+ "resolved": "https://registry.npmjs.org/@actions/github/-/github-8.0.1.tgz",
+ "integrity": "sha512-cue7mS+kx1/2Dnc/094pitRUm+0uPXVXYVaqOdZwD15BsXATWYHW3idJDYOlyBc5gJlzAQ/w5YLU4LR8D7hjVg==",
"dev": true,
"license": "MIT",
"dependencies": {
- "@octokit/types": "^13.1.0",
- "universal-user-agent": "^6.0.0"
- },
- "engines": {
- "node": ">= 18"
+ "@actions/http-client": "^3.0.2",
+ "@octokit/core": "^7.0.6",
+ "@octokit/plugin-paginate-rest": "^14.0.0",
+ "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
+ "@octokit/request": "^10.0.7",
+ "@octokit/request-error": "^7.1.0",
+ "undici": "^6.23.0"
}
},
- "node_modules/@actions/github/node_modules/@octokit/graphql": {
- "version": "7.1.0",
- "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.1.0.tgz",
- "integrity": "sha512-r+oZUH7aMFui1ypZnAvZmn0KSqAUgE1/tUXIWaqUCa1758ts/Jio84GZuzsvUkme98kv0WFY8//n0J1Z+vsIsQ==",
- "dev": true,
- "dependencies": {
- "@octokit/request": "^8.3.0",
- "@octokit/types": "^13.0.0",
- "universal-user-agent": "^6.0.0"
- },
- "engines": {
- "node": ">= 18"
- }
- },
- "node_modules/@actions/github/node_modules/@octokit/openapi-types": {
- "version": "20.0.0",
- "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
- "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
- "dev": true
- },
"node_modules/@actions/github/node_modules/@octokit/plugin-paginate-rest": {
- "version": "9.2.2",
- "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.2.tgz",
- "integrity": "sha512-u3KYkGF7GcZnSD/3UP0S7K5XUFT2FkOQdcfXZGZQPGv3lm4F2Xbf71lvjldr8c1H3nNbF+33cLEkWYbokGWqiQ==",
+ "version": "14.0.0",
+ "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz",
+ "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==",
"dev": true,
"license": "MIT",
"dependencies": {
- "@octokit/types": "^12.6.0"
+ "@octokit/types": "^16.0.0"
},
"engines": {
- "node": ">= 18"
+ "node": ">= 20"
},
"peerDependencies": {
- "@octokit/core": "5"
- }
- },
- "node_modules/@actions/github/node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
- "version": "12.6.0",
- "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
- "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
- "dev": true,
- "dependencies": {
- "@octokit/openapi-types": "^20.0.0"
+ "@octokit/core": ">=6"
}
},
"node_modules/@actions/github/node_modules/@octokit/plugin-rest-endpoint-methods": {
- "version": "10.4.1",
- "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.4.1.tgz",
- "integrity": "sha512-xV1b+ceKV9KytQe3zCVqjg+8GTGfDYwaT1ATU5isiUyVtlVAO3HNdzpS4sr4GBx4hxQ46s7ITtZrAsxG22+rVg==",
+ "version": "17.0.0",
+ "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz",
+ "integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==",
"dev": true,
+ "license": "MIT",
"dependencies": {
- "@octokit/types": "^12.6.0"
+ "@octokit/types": "^16.0.0"
},
"engines": {
- "node": ">= 18"
+ "node": ">= 20"
},
"peerDependencies": {
- "@octokit/core": "5"
- }
- },
- "node_modules/@actions/github/node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/types": {
- "version": "12.6.0",
- "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
- "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
- "dev": true,
- "dependencies": {
- "@octokit/openapi-types": "^20.0.0"
- }
- },
- "node_modules/@actions/github/node_modules/@octokit/request": {
- "version": "8.4.1",
- "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.4.1.tgz",
- "integrity": "sha512-qnB2+SY3hkCmBxZsR/MPCybNmbJe4KAlfWErXq+rBKkQJlbjdJeS85VI9r8UqeLYLvnAenU8Q1okM/0MBsAGXw==",
- "dev": true,
- "license": "MIT",
- "dependencies": {
- "@octokit/endpoint": "^9.0.6",
- "@octokit/request-error": "^5.1.1",
- "@octokit/types": "^13.1.0",
- "universal-user-agent": "^6.0.0"
- },
- "engines": {
- "node": ">= 18"
+ "@octokit/core": ">=6"
}
},
"node_modules/@actions/github/node_modules/@octokit/request-error": {
- "version": "5.1.1",
- "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
- "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+ "version": "7.1.0",
+ "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+ "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
"dev": true,
"license": "MIT",
"dependencies": {
- "@octokit/types": "^13.1.0",
- "deprecation": "^2.0.0",
- "once": "^1.4.0"
+ "@octokit/types": "^16.0.0"
},
"engines": {
- "node": ">= 18"
+ "node": ">= 20"
}
},
- "node_modules/@actions/github/node_modules/before-after-hook": {
- "version": "2.2.3",
- "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
- "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ==",
- "dev": true
- },
- "node_modules/@actions/github/node_modules/universal-user-agent": {
- "version": "6.0.1",
- "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.1.tgz",
- "integrity": "sha512-yCzhz6FN2wU1NiiQRogkTQszlQSlpWaw8SvVegAc+bDxbzHgh1vX8uIe8OYyMH6DwH+sdTJsgMl36+mSMdRJIQ==",
- "dev": true
- },
"node_modules/@actions/http-client": {
- "version": "2.2.0",
- "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.0.tgz",
- "integrity": "sha512-q+epW0trjVUUHboliPb4UF9g2msf+w61b32tAkFEwL/IwP0DQWgbCMM0Hbe3e3WXSKz5VcUXbzJQgy8Hkra/Lg==",
+ "version": "3.0.2",
+ "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+ "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
"dev": true,
+ "license": "MIT",
"dependencies": {
"tunnel": "^0.0.6",
- "undici": "^5.25.4"
+ "undici": "^6.23.0"
}
},
"node_modules/@actions/io": {
@@ -401,7 +301,6 @@
"version": "2.3.0",
"resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.3.0.tgz",
"integrity": "sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==",
- "peer": true,
"dependencies": {
"@jridgewell/gen-mapping": "^0.3.5",
"@jridgewell/trace-mapping": "^0.3.24"
@@ -587,7 +486,6 @@
"version": "7.23.3",
"resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.23.3.tgz",
"integrity": "sha512-BmR4bWbDIoFJmJ9z2cZ8Gmm2MXgEDgjdWgpKmKWUt54UGFJdlj31ECtbaDvCG/qVdG3AQ1SfpZEs01lUFbzLOQ==",
- "peer": true,
"engines": {
"node": ">=6.9.0"
}
@@ -625,14 +523,12 @@
"node_modules/@babel/core/node_modules/convert-source-map": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
- "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
- "peer": true
+ "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg=="
},
"node_modules/@babel/core/node_modules/semver": {
"version": "6.3.1",
"resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
"integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
- "peer": true,
"bin": {
"semver": "bin/semver.js"
}
@@ -666,7 +562,6 @@
"version": "7.22.15",
"resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.22.15.tgz",
"integrity": "sha512-y6EEzULok0Qvz8yyLkCvVX+02ic+By2UdOhylwUOvOn9dvYc9mKICJuuU1n1XBI02YWsNsnrY1kc6DVbjcXbtw==",
- "peer": true,
"dependencies": {
"@babel/compat-data": "^7.22.9",
"@babel/helper-validator-option": "^7.22.15",
@@ -682,7 +577,6 @@
"version": "5.1.1",
"resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
"integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
- "peer": true,
"dependencies": {
"yallist": "^3.0.2"
}
@@ -691,7 +585,6 @@
"version": "6.3.1",
"resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
"integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
- "peer": true,
"bin": {
"semver": "bin/semver.js"
}
@@ -699,8 +592,7 @@
"node_modules/@babel/helper-compilation-targets/node_modules/yallist": {
"version": "3.1.1",
"resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
- "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
- "peer": true
+ "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="
},
"node_modules/@babel/helper-environment-visitor": {
"version": "7.22.20",
@@ -748,7 +640,6 @@
"version": "7.23.3",
"resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.23.3.tgz",
"integrity": "sha512-7bBs4ED9OmswdfDzpz4MpWgSrV7FXlc3zIagvLFjS5H+Mk7Snr21vQ6QwrsoCGMfNC4e4LQPdoULEt4ykz0SRQ==",
- "peer": true,
"dependencies": {
"@babel/helper-environment-visitor": "^7.22.20",
"@babel/helper-module-imports": "^7.22.15",
@@ -775,7 +666,6 @@
"version": "7.22.5",
"resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.22.5.tgz",
"integrity": "sha512-n0H99E/K+Bika3++WNL17POvo4rKWZ7lZEp1Q+fStVbUi8nxPQEBOlTmCOxW/0JsS56SKKQ+ojAe2pHKJHN35w==",
- "peer": true,
"dependencies": {
"@babel/types": "^7.22.5"
},
@@ -814,7 +704,6 @@
"version": "7.22.15",
"resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.22.15.tgz",
"integrity": "sha512-bMn7RmyFjY/mdECUbgn9eoSY4vqvacUnS9i9vGAGttgFWesO6B4CYWA7XlpbWgBt71iv/hfbPlynohStqnu5hA==",
- "peer": true,
"engines": {
"node": ">=6.9.0"
}
@@ -823,7 +712,6 @@
"version": "7.26.10",
"resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.26.10.tgz",
"integrity": "sha512-UPYc3SauzZ3JGgj87GgZ89JVdC5dj0AoetR5Bw6wj4niittNyFh6+eOGonYvJ1ao6B8lEa3Q3klS7ADZ53bc5g==",
- "peer": true,
"dependencies": {
"@babel/template": "^7.26.9",
"@babel/types": "^7.26.10"
@@ -926,11 +814,13 @@
}
},
"node_modules/@elastic/elasticsearch": {
- "version": "8.13.1",
- "resolved": "https://registry.npmjs.org/@elastic/elasticsearch/-/elasticsearch-8.13.1.tgz",
- "integrity": "sha512-2G4Vu6OHw4+XTrp7AGIcOEezpPEoVrWg2JTK1v/exEKSLYquZkUdd+m4yOL3/UZ6bTj7hmXwrmYzW76BnLCkJQ==",
+ "version": "8.19.1",
+ "resolved": "https://registry.npmjs.org/@elastic/elasticsearch/-/elasticsearch-8.19.1.tgz",
+ "integrity": "sha512-+1j9NnQVOX+lbWB8LhCM7IkUmjU05Y4+BmSLfusq0msCsQb1Va+OUKFCoOXjCJqQrcgdRdQCjYYyolQ/npQALQ==",
+ "license": "Apache-2.0",
"dependencies": {
- "@elastic/transport": "~8.4.1",
+ "@elastic/transport": "^8.9.6",
+ "apache-arrow": "18.x - 21.x",
"tslib": "^2.4.0"
},
"engines": {
@@ -938,25 +828,52 @@
}
},
"node_modules/@elastic/transport": {
- "version": "8.4.1",
- "resolved": "https://registry.npmjs.org/@elastic/transport/-/transport-8.4.1.tgz",
- "integrity": "sha512-/SXVuVnuU5b4dq8OFY4izG+dmGla185PcoqgK6+AJMpmOeY1QYVNbWtCwvSvoAANN5D/wV+EBU8+x7Vf9EphbA==",
+ "version": "8.10.1",
+ "resolved": "https://registry.npmjs.org/@elastic/transport/-/transport-8.10.1.tgz",
+ "integrity": "sha512-xo2lPBAJEt81fQRAKa9T/gUq1SPGBHpSnVUXhoSpL996fPZRAfQwFA4BZtEUQL1p8Dezodd3ZN8Wwno+mYyKuw==",
+ "license": "Apache-2.0",
"dependencies": {
- "debug": "^4.3.4",
- "hpagent": "^1.0.0",
+ "@opentelemetry/api": "1.x",
+ "@opentelemetry/core": "2.x",
+ "debug": "^4.4.1",
+ "hpagent": "^1.2.0",
"ms": "^2.1.3",
- "secure-json-parse": "^2.4.0",
- "tslib": "^2.4.0",
- "undici": "^5.22.1"
+ "secure-json-parse": "^3.0.1",
+ "tslib": "^2.8.1",
+ "undici": "^6.21.1"
},
"engines": {
- "node": ">=16"
+ "node": ">=18"
+ }
+ },
+ "node_modules/@elastic/transport/node_modules/debug": {
+ "version": "4.4.3",
+ "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+ "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+ "license": "MIT",
+ "dependencies": {
+ "ms": "^2.1.3"
+ },
+ "engines": {
+ "node": ">=6.0"
+ },
+ "peerDependenciesMeta": {
+ "supports-color": {
+ "optional": true
+ }
}
},
"node_modules/@elastic/transport/node_modules/ms": {
"version": "2.1.3",
"resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
- "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
+ "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+ "license": "MIT"
+ },
+ "node_modules/@elastic/transport/node_modules/tslib": {
+ "version": "2.8.1",
+ "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+ "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+ "license": "0BSD"
},
"node_modules/@emnapi/core": {
"version": "1.4.3",
@@ -1616,14 +1533,6 @@
"node": "^18.18.0 || ^20.9.0 || >=21.1.0"
}
},
- "node_modules/@fastify/busboy": {
- "version": "2.0.0",
- "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.0.0.tgz",
- "integrity": "sha512-JUFJad5lv7jxj926GPgymrWQxxjPYuJNiNjNMzqT+HiuP6Vl3dk5xzG+8sTX96np0ZAluvaMzPsjhHZ5rNuNQQ==",
- "engines": {
- "node": ">=14"
- }
- },
"node_modules/@file-type/xml": {
"version": "0.4.3",
"resolved": "https://registry.npmjs.org/@file-type/xml/-/xml-0.4.3.tgz",
@@ -1688,6 +1597,12 @@
"npm": ">= 7.x"
}
},
+ "node_modules/@github/hydro-analytics-client": {
+ "version": "2.3.3",
+ "resolved": "https://registry.npmjs.org/@github/hydro-analytics-client/-/hydro-analytics-client-2.3.3.tgz",
+ "integrity": "sha512-zjelWB1hWOZ+CKHi5alBB5cclWmBedM0zABXoeJwVHCebwYg0XSBmKgYtlakYyuNaNRa3v4sGbbU1ts56Pl29Q==",
+ "license": "MIT"
+ },
"node_modules/@github/image-crop-element": {
"version": "5.0.0",
"resolved": "https://registry.npmjs.org/@github/image-crop-element/-/image-crop-element-5.0.0.tgz",
@@ -1744,13 +1659,14 @@
}
},
"node_modules/@graphql-inspector/core": {
- "version": "6.1.0",
- "resolved": "https://registry.npmjs.org/@graphql-inspector/core/-/core-6.1.0.tgz",
- "integrity": "sha512-5/kqD5330duUsfMBfhMc0iVld76JwSKTkKi7aOr1x9MvSnP8p1anQo7BCNZ5VY9+EvWn4njHbkNfdS/lrqsi+A==",
+ "version": "7.0.3",
+ "resolved": "https://registry.npmjs.org/@graphql-inspector/core/-/core-7.0.3.tgz",
+ "integrity": "sha512-85WkFZkC2GjGLTf+PB6L347zJhQLZ7FH5OoMz6EXoacFjd6iQ5Xf/Qdz3Vu1tjLY70ZKj7jddI4GEPompNSkJg==",
"dev": true,
+ "license": "MIT",
"dependencies": {
"dependency-graph": "1.0.0",
- "object-inspect": "1.13.1",
+ "object-inspect": "1.13.2",
"tslib": "2.6.2"
},
"engines": {
@@ -2383,6 +2299,7 @@
"version": "8.0.2",
"resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
"integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+ "license": "ISC",
"dependencies": {
"string-width": "^5.1.2",
"string-width-cjs": "npm:string-width@^4.2.0",
@@ -2396,9 +2313,10 @@
}
},
"node_modules/@isaacs/cliui/node_modules/ansi-styles": {
- "version": "6.2.1",
- "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.1.tgz",
- "integrity": "sha512-bN798gFfQX+viw3R7yrGWRqnrN2oRkEkUjjl4JNn4E8GxxbjtG3FbrEIIY3l8/hrwUwIeCZvi4QuOTP4MErVug==",
+ "version": "6.2.3",
+ "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
+ "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
+ "license": "MIT",
"engines": {
"node": ">=12"
},
@@ -2410,6 +2328,7 @@
"version": "5.1.2",
"resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
"integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
+ "license": "MIT",
"dependencies": {
"eastasianwidth": "^0.2.0",
"emoji-regex": "^9.2.2",
@@ -2426,6 +2345,7 @@
"version": "8.1.0",
"resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
"integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
+ "license": "MIT",
"dependencies": {
"ansi-styles": "^6.1.0",
"string-width": "^5.0.1",
@@ -2524,15 +2444,15 @@
}
},
"node_modules/@next/env": {
- "version": "16.0.1",
- "resolved": "https://registry.npmjs.org/@next/env/-/env-16.0.1.tgz",
- "integrity": "sha512-LFvlK0TG2L3fEOX77OC35KowL8D7DlFF45C0OvKMC4hy8c/md1RC4UMNDlUGJqfCoCS2VWrZ4dSE6OjaX5+8mw==",
+ "version": "16.1.5",
+ "resolved": "https://registry.npmjs.org/@next/env/-/env-16.1.5.tgz",
+ "integrity": "sha512-CRSCPJiSZoi4Pn69RYBDI9R7YK2g59vLexPQFXY0eyw+ILevIenCywzg+DqmlBik9zszEnw2HLFOUlLAcJbL7g==",
"license": "MIT"
},
"node_modules/@next/swc-darwin-arm64": {
- "version": "16.0.1",
- "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.0.1.tgz",
- "integrity": "sha512-R0YxRp6/4W7yG1nKbfu41bp3d96a0EalonQXiMe+1H9GTHfKxGNCGFNWUho18avRBPsO8T3RmdWuzmfurlQPbg==",
+ "version": "16.1.5",
+ "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.1.5.tgz",
+ "integrity": "sha512-eK7Wdm3Hjy/SCL7TevlH0C9chrpeOYWx2iR7guJDaz4zEQKWcS1IMVfMb9UKBFMg1XgzcPTYPIp1Vcpukkjg6Q==",
"cpu": [
"arm64"
],
@@ -2546,9 +2466,9 @@
}
},
"node_modules/@next/swc-darwin-x64": {
- "version": "16.0.1",
- "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.0.1.tgz",
- "integrity": "sha512-kETZBocRux3xITiZtOtVoVvXyQLB7VBxN7L6EPqgI5paZiUlnsgYv4q8diTNYeHmF9EiehydOBo20lTttCbHAg==",
+ "version": "16.1.5",
+ "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.1.5.tgz",
+ "integrity": "sha512-foQscSHD1dCuxBmGkbIr6ScAUF6pRoDZP6czajyvmXPAOFNnQUJu2Os1SGELODjKp/ULa4fulnBWoHV3XdPLfA==",
"cpu": [
"x64"
],
@@ -2562,9 +2482,9 @@
}
},
"node_modules/@next/swc-linux-arm64-gnu": {
- "version": "16.0.1",
- "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.0.1.tgz",
- "integrity": "sha512-hWg3BtsxQuSKhfe0LunJoqxjO4NEpBmKkE+P2Sroos7yB//OOX3jD5ISP2wv8QdUwtRehMdwYz6VB50mY6hqAg==",
+ "version": "16.1.5",
+ "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.1.5.tgz",
+ "integrity": "sha512-qNIb42o3C02ccIeSeKjacF3HXotGsxh/FMk/rSRmCzOVMtoWH88odn2uZqF8RLsSUWHcAqTgYmPD3pZ03L9ZAA==",
"cpu": [
"arm64"
],
@@ -2578,9 +2498,9 @@
}
},
"node_modules/@next/swc-linux-arm64-musl": {
- "version": "16.0.1",
- "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.0.1.tgz",
- "integrity": "sha512-UPnOvYg+fjAhP3b1iQStcYPWeBFRLrugEyK/lDKGk7kLNua8t5/DvDbAEFotfV1YfcOY6bru76qN9qnjLoyHCQ==",
+ "version": "16.1.5",
+ "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.1.5.tgz",
+ "integrity": "sha512-U+kBxGUY1xMAzDTXmuVMfhaWUZQAwzRaHJ/I6ihtR5SbTVUEaDRiEU9YMjy1obBWpdOBuk1bcm+tsmifYSygfw==",
"cpu": [
"arm64"
],
@@ -2594,9 +2514,9 @@
}
},
"node_modules/@next/swc-linux-x64-gnu": {
- "version": "16.0.1",
- "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.0.1.tgz",
- "integrity": "sha512-Et81SdWkcRqAJziIgFtsFyJizHoWne4fzJkvjd6V4wEkWTB4MX6J0uByUb0peiJQ4WeAt6GGmMszE5KrXK6WKg==",
+ "version": "16.1.5",
+ "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.1.5.tgz",
+ "integrity": "sha512-gq2UtoCpN7Ke/7tKaU7i/1L7eFLfhMbXjNghSv0MVGF1dmuoaPeEVDvkDuO/9LVa44h5gqpWeJ4mRRznjDv7LA==",
"cpu": [
"x64"
],
@@ -2610,9 +2530,9 @@
}
},
"node_modules/@next/swc-linux-x64-musl": {
- "version": "16.0.1",
- "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.0.1.tgz",
- "integrity": "sha512-qBbgYEBRrC1egcG03FZaVfVxrJm8wBl7vr8UFKplnxNRprctdP26xEv9nJ07Ggq4y1adwa0nz2mz83CELY7N6Q==",
+ "version": "16.1.5",
+ "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.1.5.tgz",
+ "integrity": "sha512-bQWSE729PbXT6mMklWLf8dotislPle2L70E9q6iwETYEOt092GDn0c+TTNj26AjmeceSsC4ndyGsK5nKqHYXjQ==",
"cpu": [
"x64"
],
@@ -2626,9 +2546,9 @@
}
},
"node_modules/@next/swc-win32-arm64-msvc": {
- "version": "16.0.1",
- "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.0.1.tgz",
- "integrity": "sha512-cPuBjYP6I699/RdbHJonb3BiRNEDm5CKEBuJ6SD8k3oLam2fDRMKAvmrli4QMDgT2ixyRJ0+DTkiODbIQhRkeQ==",
+ "version": "16.1.5",
+ "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.1.5.tgz",
+ "integrity": "sha512-LZli0anutkIllMtTAWZlDqdfvjWX/ch8AFK5WgkNTvaqwlouiD1oHM+WW8RXMiL0+vAkAJyAGEzPPjO+hnrSNQ==",
"cpu": [
"arm64"
],
@@ -2642,9 +2562,9 @@
}
},
"node_modules/@next/swc-win32-x64-msvc": {
- "version": "16.0.1",
- "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.0.1.tgz",
- "integrity": "sha512-XeEUJsE4JYtfrXe/LaJn3z1pD19fK0Q6Er8Qoufi+HqvdO4LEPyCxLUt4rxA+4RfYo6S9gMlmzCMU2F+AatFqQ==",
+ "version": "16.1.5",
+ "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.1.5.tgz",
+ "integrity": "sha512-7is37HJTNQGhjPpQbkKjKEboHYQnCgpVt/4rBrrln0D9nderNxZ8ZWs8w1fAtzUx7wEyYjQ+/13myFgFj6K2Ng==",
"cpu": [
"x64"
],
@@ -2704,15 +2624,17 @@
}
},
"node_modules/@octokit/core": {
- "version": "7.0.2",
- "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.2.tgz",
- "integrity": "sha512-ODsoD39Lq6vR6aBgvjTnA3nZGliknKboc9Gtxr7E4WDNqY24MxANKcuDQSF0jzapvGb3KWOEDrKfve4HoWGK+g==",
+ "version": "7.0.6",
+ "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
+ "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
+ "license": "MIT",
+ "peer": true,
"dependencies": {
"@octokit/auth-token": "^6.0.0",
- "@octokit/graphql": "^9.0.1",
- "@octokit/request": "^10.0.2",
- "@octokit/request-error": "^7.0.0",
- "@octokit/types": "^14.0.0",
+ "@octokit/graphql": "^9.0.3",
+ "@octokit/request": "^10.0.6",
+ "@octokit/request-error": "^7.0.2",
+ "@octokit/types": "^16.0.0",
"before-after-hook": "^4.0.0",
"universal-user-agent": "^7.0.0"
},
@@ -2720,48 +2642,50 @@
"node": ">= 20"
}
},
- "node_modules/@octokit/core/node_modules/@octokit/openapi-types": {
- "version": "25.0.0",
- "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.0.0.tgz",
- "integrity": "sha512-FZvktFu7HfOIJf2BScLKIEYjDsw6RKc7rBJCdvCTfKsVnx2GEB/Nbzjr29DUdb7vQhlzS/j8qDzdditP0OC6aw=="
- },
- "node_modules/@octokit/core/node_modules/@octokit/types": {
- "version": "14.0.0",
- "resolved": "https://registry.npmjs.org/@octokit/types/-/types-14.0.0.tgz",
- "integrity": "sha512-VVmZP0lEhbo2O1pdq63gZFiGCKkm8PPp8AUOijlwPO6hojEVjspA0MWKP7E4hbvGxzFKNqKr6p0IYtOH/Wf/zA==",
+ "node_modules/@octokit/core/node_modules/@octokit/graphql": {
+ "version": "9.0.3",
+ "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
+ "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
+ "license": "MIT",
"dependencies": {
- "@octokit/openapi-types": "^25.0.0"
+ "@octokit/request": "^10.0.6",
+ "@octokit/types": "^16.0.0",
+ "universal-user-agent": "^7.0.0"
+ },
+ "engines": {
+ "node": ">= 20"
}
},
- "node_modules/@octokit/endpoint": {
- "version": "11.0.0",
- "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.0.tgz",
- "integrity": "sha512-hoYicJZaqISMAI3JfaDr1qMNi48OctWuOih1m80bkYow/ayPw6Jj52tqWJ6GEoFTk1gBqfanSoI1iY99Z5+ekQ==",
+ "node_modules/@octokit/core/node_modules/@octokit/request-error": {
+ "version": "7.1.0",
+ "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+ "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
+ "license": "MIT",
"dependencies": {
- "@octokit/types": "^14.0.0",
- "universal-user-agent": "^7.0.2"
+ "@octokit/types": "^16.0.0"
},
"engines": {
"node": ">= 20"
}
},
- "node_modules/@octokit/endpoint/node_modules/@octokit/openapi-types": {
- "version": "25.0.0",
- "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.0.0.tgz",
- "integrity": "sha512-FZvktFu7HfOIJf2BScLKIEYjDsw6RKc7rBJCdvCTfKsVnx2GEB/Nbzjr29DUdb7vQhlzS/j8qDzdditP0OC6aw=="
- },
- "node_modules/@octokit/endpoint/node_modules/@octokit/types": {
- "version": "14.0.0",
- "resolved": "https://registry.npmjs.org/@octokit/types/-/types-14.0.0.tgz",
- "integrity": "sha512-VVmZP0lEhbo2O1pdq63gZFiGCKkm8PPp8AUOijlwPO6hojEVjspA0MWKP7E4hbvGxzFKNqKr6p0IYtOH/Wf/zA==",
+ "node_modules/@octokit/endpoint": {
+ "version": "11.0.2",
+ "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.2.tgz",
+ "integrity": "sha512-4zCpzP1fWc7QlqunZ5bSEjxc6yLAlRTnDwKtgXfcI/FxxGoqedDG8V2+xJ60bV2kODqcGB+nATdtap/XYq2NZQ==",
+ "license": "MIT",
"dependencies": {
- "@octokit/openapi-types": "^25.0.0"
+ "@octokit/types": "^16.0.0",
+ "universal-user-agent": "^7.0.2"
+ },
+ "engines": {
+ "node": ">= 20"
}
},
"node_modules/@octokit/graphql": {
"version": "9.0.1",
"resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.1.tgz",
"integrity": "sha512-j1nQNU1ZxNFx2ZtKmL4sMrs4egy5h65OMDmSbVyuCzjOcwsHq6EaYjOTGXPQxgfiN8dJ4CriYHk6zF050WEULg==",
+ "license": "MIT",
"dependencies": {
"@octokit/request": "^10.0.2",
"@octokit/types": "^14.0.0",
@@ -2785,10 +2709,9 @@
}
},
"node_modules/@octokit/openapi-types": {
- "version": "23.0.1",
- "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-23.0.1.tgz",
- "integrity": "sha512-izFjMJ1sir0jn0ldEKhZ7xegCTj/ObmEDlEfpFrx4k/JyZSMRHbO3/rBwgE7f3m2DHt+RrNGIVw4wSmwnm3t/g==",
- "dev": true,
+ "version": "27.0.0",
+ "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
+ "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
"license": "MIT"
},
"node_modules/@octokit/plugin-paginate-rest": {
@@ -2893,13 +2816,14 @@
}
},
"node_modules/@octokit/request": {
- "version": "10.0.2",
- "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.2.tgz",
- "integrity": "sha512-iYj4SJG/2bbhh+iIpFmG5u49DtJ4lipQ+aPakjL9OKpsGY93wM8w06gvFbEQxcMsZcCvk5th5KkIm2m8o14aWA==",
+ "version": "10.0.7",
+ "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.7.tgz",
+ "integrity": "sha512-v93h0i1yu4idj8qFPZwjehoJx4j3Ntn+JhXsdJrG9pYaX6j/XRz2RmasMUHtNgQD39nrv/VwTWSqK0RNXR8upA==",
+ "license": "MIT",
"dependencies": {
- "@octokit/endpoint": "^11.0.0",
- "@octokit/request-error": "^7.0.0",
- "@octokit/types": "^14.0.0",
+ "@octokit/endpoint": "^11.0.2",
+ "@octokit/request-error": "^7.0.2",
+ "@octokit/types": "^16.0.0",
"fast-content-type-parse": "^3.0.0",
"universal-user-agent": "^7.0.2"
},
@@ -2933,17 +2857,16 @@
"@octokit/openapi-types": "^25.0.0"
}
},
- "node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
- "version": "25.0.0",
- "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.0.0.tgz",
- "integrity": "sha512-FZvktFu7HfOIJf2BScLKIEYjDsw6RKc7rBJCdvCTfKsVnx2GEB/Nbzjr29DUdb7vQhlzS/j8qDzdditP0OC6aw=="
- },
- "node_modules/@octokit/request/node_modules/@octokit/types": {
- "version": "14.0.0",
- "resolved": "https://registry.npmjs.org/@octokit/types/-/types-14.0.0.tgz",
- "integrity": "sha512-VVmZP0lEhbo2O1pdq63gZFiGCKkm8PPp8AUOijlwPO6hojEVjspA0MWKP7E4hbvGxzFKNqKr6p0IYtOH/Wf/zA==",
+ "node_modules/@octokit/request/node_modules/@octokit/request-error": {
+ "version": "7.1.0",
+ "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+ "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
+ "license": "MIT",
"dependencies": {
- "@octokit/openapi-types": "^25.0.0"
+ "@octokit/types": "^16.0.0"
+ },
+ "engines": {
+ "node": ">= 20"
}
},
"node_modules/@octokit/rest": {
@@ -2962,13 +2885,12 @@
}
},
"node_modules/@octokit/types": {
- "version": "13.8.0",
- "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.8.0.tgz",
- "integrity": "sha512-x7DjTIbEpEWXK99DMd01QfWy0hd5h4EN+Q7shkdKds3otGQP+oWE/y0A76i1OvH9fygo4ddvNf7ZvF0t78P98A==",
- "dev": true,
+ "version": "16.0.0",
+ "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
+ "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
"license": "MIT",
"dependencies": {
- "@octokit/openapi-types": "^23.0.1"
+ "@octokit/openapi-types": "^27.0.0"
}
},
"node_modules/@oddbird/popover-polyfill": {
@@ -3002,6 +2924,40 @@
"dev": true,
"license": "MIT"
},
+ "node_modules/@opentelemetry/api": {
+ "version": "1.9.0",
+ "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
+ "integrity": "sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==",
+ "license": "Apache-2.0",
+ "peer": true,
+ "engines": {
+ "node": ">=8.0.0"
+ }
+ },
+ "node_modules/@opentelemetry/core": {
+ "version": "2.5.0",
+ "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.5.0.tgz",
+ "integrity": "sha512-ka4H8OM6+DlUhSAZpONu0cPBtPPTQKxbxVzC4CzVx5+K4JnroJVBtDzLAMx4/3CDTJXRvVFhpFjtl4SaiTNoyQ==",
+ "license": "Apache-2.0",
+ "dependencies": {
+ "@opentelemetry/semantic-conventions": "^1.29.0"
+ },
+ "engines": {
+ "node": "^18.19.0 || >=20.6.0"
+ },
+ "peerDependencies": {
+ "@opentelemetry/api": ">=1.0.0 <1.10.0"
+ }
+ },
+ "node_modules/@opentelemetry/semantic-conventions": {
+ "version": "1.39.0",
+ "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.39.0.tgz",
+ "integrity": "sha512-R5R9tb2AXs2IRLNKLBJDynhkfmx7mX0vi8NkhZb3gUkPWHn6HXk5J8iQ/dql0U3ApfWym4kXXmBDRGO+oeOfjg==",
+ "license": "Apache-2.0",
+ "engines": {
+ "node": ">=14"
+ }
+ },
"node_modules/@parcel/watcher": {
"version": "2.5.1",
"resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.1.tgz",
@@ -3326,15 +3282,6 @@
"node": ">=0.10"
}
},
- "node_modules/@pkgjs/parseargs": {
- "version": "0.11.0",
- "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
- "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
- "optional": true,
- "engines": {
- "node": ">=14"
- }
- },
"node_modules/@pkgr/core": {
"version": "0.2.9",
"resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
@@ -3354,6 +3301,7 @@
"integrity": "sha512-vSMYtL/zOcFpvJCW71Q/OEGQb7KYBPAdKh35WNSkaZA75JlAO8ED8UN6GUNTm3drWomcbcqRPFqQbLae8yBTdg==",
"devOptional": true,
"license": "Apache-2.0",
+ "peer": true,
"dependencies": {
"playwright": "1.56.1"
},
@@ -3383,6 +3331,12 @@
"node": ">=16.0.0"
}
},
+ "node_modules/@primer/css/node_modules/@primer/primitives": {
+ "version": "7.17.1",
+ "resolved": "https://registry.npmjs.org/@primer/primitives/-/primitives-7.17.1.tgz",
+ "integrity": "sha512-SiPzEb+up1nDpV2NGwNiY8m6sGnF3OUqRb0has5s6T40vq6Li/g3cYVgl+oolEa4DUoNygEPs09jwJt24f/3zg==",
+ "license": "MIT"
+ },
"node_modules/@primer/live-region-element": {
"version": "0.7.2",
"resolved": "https://registry.npmjs.org/@primer/live-region-element/-/live-region-element-0.7.2.tgz",
@@ -3414,9 +3368,9 @@
}
},
"node_modules/@primer/primitives": {
- "version": "7.17.1",
- "resolved": "https://registry.npmjs.org/@primer/primitives/-/primitives-7.17.1.tgz",
- "integrity": "sha512-SiPzEb+up1nDpV2NGwNiY8m6sGnF3OUqRb0has5s6T40vq6Li/g3cYVgl+oolEa4DUoNygEPs09jwJt24f/3zg==",
+ "version": "11.3.1",
+ "resolved": "https://registry.npmjs.org/@primer/primitives/-/primitives-11.3.1.tgz",
+ "integrity": "sha512-f5FXeUHQ0iyxt1UF6MqeajQ9jRV/7uOGLECU5KuFWhMioCZOho09jS6alZA9tiwksHr2LYXfo7AdFczpEz3Npw==",
"license": "MIT"
},
"node_modules/@primer/react": {
@@ -3481,12 +3435,6 @@
"integrity": "sha512-iFrvar5SOMtKFOSjYvs4z9UlLqDdJbMx0mgISLcPedv+g0ac5sgeETLGtipHCVIae6HJPclNEH5aCyD1RZaEHw==",
"license": "BSD-3-Clause"
},
- "node_modules/@primer/react/node_modules/@primer/primitives": {
- "version": "11.1.0",
- "resolved": "https://registry.npmjs.org/@primer/primitives/-/primitives-11.1.0.tgz",
- "integrity": "sha512-edsofzVG67EobXGRrqFc/kfjzKh8wbq1wEmRc1vmRNqDJNMxBRWZ9bT2AzKvcv+Hbf7olDAPkrSqVHbO4hhr/A==",
- "license": "MIT"
- },
"node_modules/@primer/view-components": {
"version": "0.22.0",
"resolved": "https://registry.npmjs.org/@primer/view-components/-/view-components-0.22.0.tgz",
@@ -4075,6 +4023,18 @@
"@types/node": "*"
}
},
+ "node_modules/@types/command-line-args": {
+ "version": "5.2.3",
+ "resolved": "https://registry.npmjs.org/@types/command-line-args/-/command-line-args-5.2.3.tgz",
+ "integrity": "sha512-uv0aG6R0Y8WHZLTamZwtfsDLVRnOa+n+n5rEvFWL5Na5gZ8V2Teab/duDPFzIIIhs9qizDpcavCusCLJZu62Kw==",
+ "license": "MIT"
+ },
+ "node_modules/@types/command-line-usage": {
+ "version": "5.0.4",
+ "resolved": "https://registry.npmjs.org/@types/command-line-usage/-/command-line-usage-5.0.4.tgz",
+ "integrity": "sha512-BwR5KP3Es/CSht0xqBcUXS3qCAUVXwpRKsV2+arxeb65atasuXG9LykC9Ab10Cw3s2raH92ZqOeILaQbsB2ACg==",
+ "license": "MIT"
+ },
"node_modules/@types/connect": {
"version": "3.4.38",
"resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.38.tgz",
@@ -4165,6 +4125,7 @@
"integrity": "sha512-wGA0NX93b19/dZC1J18tKWVIYWyyF2ZjT9vin/NRu0qzzvfVzWjs04iq2rQ3H65vCTQYlRqs3YHfY7zjdV+9Kw==",
"dev": true,
"license": "MIT",
+ "peer": true,
"dependencies": {
"@types/body-parser": "*",
"@types/express-serve-static-core": "^5.0.0",
@@ -4326,6 +4287,7 @@
"resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.20.tgz",
"integrity": "sha512-IPaCZN7PShZK/3t6Q87pfTkRm6oLTd4vztyoj+cbHUF1g3FfVb2tFIL79uCRKEfv16AhqDMBywP2VW3KIZUvcg==",
"license": "MIT",
+ "peer": true,
"dependencies": {
"@types/prop-types": "*",
"csstype": "^3.0.2"
@@ -4337,6 +4299,7 @@
"integrity": "sha512-nf22//wEbKXusP6E9pfOCDwFdHAX4u172eaJI4YkDRQEZiorm6KfYnSC2SWLDMVWUOWPERmJnN0ujeAfTBLvrw==",
"devOptional": true,
"license": "MIT",
+ "peer": true,
"peerDependencies": {
"@types/react": "^18.0.0"
}
@@ -4507,6 +4470,7 @@
"integrity": "sha512-pUXGCuHnnKw6PyYq93lLRiZm3vjuslIy7tus1lIQTYVK9bL8XBgJnCWm8a0KcTtHC84Yya1Q6rtll+duSMj0dg==",
"dev": true,
"license": "MIT",
+ "peer": true,
"dependencies": {
"@typescript-eslint/scope-manager": "8.39.1",
"@typescript-eslint/types": "8.39.1",
@@ -5152,6 +5116,7 @@
"integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
"dev": true,
"license": "MIT",
+ "peer": true,
"bin": {
"acorn": "bin/acorn"
},
@@ -5181,6 +5146,7 @@
"version": "8.17.1",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz",
"integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==",
+ "peer": true,
"dependencies": {
"fast-deep-equal": "^3.1.3",
"fast-uri": "^3.0.1",
@@ -5269,6 +5235,26 @@
"node": ">= 8"
}
},
+ "node_modules/apache-arrow": {
+ "version": "21.1.0",
+ "resolved": "https://registry.npmjs.org/apache-arrow/-/apache-arrow-21.1.0.tgz",
+ "integrity": "sha512-kQrYLxhC+NTVVZ4CCzGF6L/uPVOzJmD1T3XgbiUnP7oTeVFOFgEUu6IKNwCDkpFoBVqDKQivlX4RUFqqnWFlEA==",
+ "license": "Apache-2.0",
+ "dependencies": {
+ "@swc/helpers": "^0.5.11",
+ "@types/command-line-args": "^5.2.3",
+ "@types/command-line-usage": "^5.0.4",
+ "@types/node": "^24.0.3",
+ "command-line-args": "^6.0.1",
+ "command-line-usage": "^7.0.1",
+ "flatbuffers": "^25.1.24",
+ "json-bignum": "^0.0.3",
+ "tslib": "^2.6.2"
+ },
+ "bin": {
+ "arrow2csv": "bin/arrow2csv.js"
+ }
+ },
"node_modules/arg": {
"version": "5.0.2",
"dev": true,
@@ -5288,6 +5274,15 @@
"node": ">= 0.4"
}
},
+ "node_modules/array-back": {
+ "version": "6.2.2",
+ "resolved": "https://registry.npmjs.org/array-back/-/array-back-6.2.2.tgz",
+ "integrity": "sha512-gUAZ7HPyb4SJczXAMUXMGAvI976JoK3qEx9v1FTmeYuJj0IBiaKttG1ydtGKdkfqWkIkouke7nG8ufGy77+Cvw==",
+ "license": "MIT",
+ "engines": {
+ "node": ">=12.17"
+ }
+ },
"node_modules/array-buffer-byte-length": {
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/array-buffer-byte-length/-/array-buffer-byte-length-1.0.2.tgz",
@@ -5533,6 +5528,15 @@
"version": "1.0.2",
"license": "MIT"
},
+ "node_modules/baseline-browser-mapping": {
+ "version": "2.9.18",
+ "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.18.tgz",
+ "integrity": "sha512-e23vBV1ZLfjb9apvfPk4rHVu2ry6RIr2Wfs+O324okSidrX7pTAnEJPCh/O5BtRlr7QtZI7ktOP3vsqr7Z5XoA==",
+ "license": "Apache-2.0",
+ "bin": {
+ "baseline-browser-mapping": "dist/cli.js"
+ }
+ },
"node_modules/before-after-hook": {
"version": "4.0.0",
"resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
@@ -5561,25 +5565,52 @@
"license": "MIT"
},
"node_modules/body-parser": {
- "version": "2.2.0",
- "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.0.tgz",
- "integrity": "sha512-02qvAaxv8tp7fBa/mw1ga98OGm+eCbqzJOKoRt70sLmfEEi+jyBYVTDGfCL/k06/4EMk/z01gCe7HoCH/f2LTg==",
+ "version": "2.2.1",
+ "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.1.tgz",
+ "integrity": "sha512-nfDwkulwiZYQIGwxdy0RUmowMhKcFVcYXUU7m4QlKYim1rUtg83xm2yjZ40QjDuc291AJjjeSc9b++AWHSgSHw==",
"license": "MIT",
"dependencies": {
"bytes": "^3.1.2",
"content-type": "^1.0.5",
- "debug": "^4.4.0",
+ "debug": "^4.4.3",
"http-errors": "^2.0.0",
- "iconv-lite": "^0.6.3",
+ "iconv-lite": "^0.7.0",
"on-finished": "^2.4.1",
"qs": "^6.14.0",
- "raw-body": "^3.0.0",
- "type-is": "^2.0.0"
+ "raw-body": "^3.0.1",
+ "type-is": "^2.0.1"
},
"engines": {
"node": ">=18"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/express"
}
},
+ "node_modules/body-parser/node_modules/debug": {
+ "version": "4.4.3",
+ "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+ "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+ "license": "MIT",
+ "dependencies": {
+ "ms": "^2.1.3"
+ },
+ "engines": {
+ "node": ">=6.0"
+ },
+ "peerDependenciesMeta": {
+ "supports-color": {
+ "optional": true
+ }
+ }
+ },
+ "node_modules/body-parser/node_modules/ms": {
+ "version": "2.1.3",
+ "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+ "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+ "license": "MIT"
+ },
"node_modules/body-parser/node_modules/on-finished": {
"version": "2.4.1",
"resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
@@ -5646,6 +5677,7 @@
"version": "2.0.2",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
"integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+ "dev": true,
"dependencies": {
"balanced-match": "^1.0.0"
}
@@ -5680,6 +5712,7 @@
}
],
"license": "MIT",
+ "peer": true,
"dependencies": {
"caniuse-lite": "^1.0.30001733",
"electron-to-chromium": "^1.5.199",
@@ -5875,6 +5908,37 @@
"url": "https://github.com/chalk/chalk?sponsor=1"
}
},
+ "node_modules/chalk-template": {
+ "version": "0.4.0",
+ "resolved": "https://registry.npmjs.org/chalk-template/-/chalk-template-0.4.0.tgz",
+ "integrity": "sha512-/ghrgmhfY8RaSdeo43hNXxpoHAtxdbskUHjPpfqUWGttFgycUhYPGx3YZBCnUCvOa7Doivn1IZec3DEGFoMgLg==",
+ "license": "MIT",
+ "dependencies": {
+ "chalk": "^4.1.2"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/chalk/chalk-template?sponsor=1"
+ }
+ },
+ "node_modules/chalk-template/node_modules/chalk": {
+ "version": "4.1.2",
+ "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+ "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+ "license": "MIT",
+ "dependencies": {
+ "ansi-styles": "^4.1.0",
+ "supports-color": "^7.1.0"
+ },
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/chalk/chalk?sponsor=1"
+ }
+ },
"node_modules/change-case": {
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/change-case/-/change-case-5.4.4.tgz",
@@ -5930,6 +5994,7 @@
"resolved": "https://registry.npmjs.org/cheerio/-/cheerio-1.0.0-rc.12.tgz",
"integrity": "sha512-VqR8m68vM46BNnuZ5NtnGBKIE/DfN0cRIzg9n40EIq9NOv90ayxLBXA8fXC5gquFRGJSTRqBq25Jt2ECLR431Q==",
"license": "MIT",
+ "peer": true,
"dependencies": {
"cheerio-select": "^2.1.0",
"dom-serializer": "^2.0.0",
@@ -6170,6 +6235,44 @@
"url": "https://github.com/sponsors/wooorm"
}
},
+ "node_modules/command-line-args": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/command-line-args/-/command-line-args-6.0.1.tgz",
+ "integrity": "sha512-Jr3eByUjqyK0qd8W0SGFW1nZwqCaNCtbXjRo2cRJC1OYxWl3MZ5t1US3jq+cO4sPavqgw4l9BMGX0CBe+trepg==",
+ "license": "MIT",
+ "dependencies": {
+ "array-back": "^6.2.2",
+ "find-replace": "^5.0.2",
+ "lodash.camelcase": "^4.3.0",
+ "typical": "^7.2.0"
+ },
+ "engines": {
+ "node": ">=12.20"
+ },
+ "peerDependencies": {
+ "@75lb/nature": "latest"
+ },
+ "peerDependenciesMeta": {
+ "@75lb/nature": {
+ "optional": true
+ }
+ }
+ },
+ "node_modules/command-line-usage": {
+ "version": "7.0.3",
+ "resolved": "https://registry.npmjs.org/command-line-usage/-/command-line-usage-7.0.3.tgz",
+ "integrity": "sha512-PqMLy5+YGwhMh1wS04mVG44oqDsgyLRSKJBdOo1bnYhMKBW65gZF1dRp2OZRhiTjgUHljy99qkO7bsctLaw35Q==",
+ "license": "MIT",
+ "dependencies": {
+ "array-back": "^6.2.2",
+ "chalk-template": "^0.4.0",
+ "table-layout": "^4.1.0",
+ "typical": "^7.1.1"
+ },
+ "engines": {
+ "node": ">=12.20.0"
+ }
+ },
"node_modules/commander": {
"version": "14.0.0",
"resolved": "https://registry.npmjs.org/commander/-/commander-14.0.0.tgz",
@@ -6688,12 +6791,6 @@
"node": ">=4"
}
},
- "node_modules/deprecation": {
- "version": "2.3.1",
- "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
- "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ==",
- "dev": true
- },
"node_modules/dequal": {
"version": "2.0.3",
"resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
@@ -6843,6 +6940,8 @@
},
"node_modules/eastasianwidth": {
"version": "0.2.0",
+ "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
+ "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
"license": "MIT"
},
"node_modules/ecdsa-sig-formatter": {
@@ -7167,6 +7266,7 @@
"integrity": "sha512-TS9bTNIryDzStCpJN93aC5VRSW3uTx9sClUn4B87pwiCaJh220otoI0X8mJKr+VcPtniMdN8GKjlwgWGUv5ZKA==",
"dev": true,
"license": "MIT",
+ "peer": true,
"dependencies": {
"@eslint-community/eslint-utils": "^4.2.0",
"@eslint-community/regexpp": "^4.12.1",
@@ -7228,6 +7328,7 @@
"integrity": "sha512-82GZUjRS0p/jganf6q1rEO25VSoHH0hKPCTrgillPjdI/3bgBhAE1QzHrHTizjpRvy6pGAvKjDJtk2pF9NDq8w==",
"dev": true,
"license": "MIT",
+ "peer": true,
"bin": {
"eslint-config-prettier": "bin/cli.js"
},
@@ -7373,6 +7474,10 @@
"ms": "^2.1.1"
}
},
+ "node_modules/eslint-plugin-custom-rules": {
+ "resolved": "src/eslint-rules",
+ "link": true
+ },
"node_modules/eslint-plugin-escompat": {
"version": "3.11.4",
"resolved": "https://registry.npmjs.org/eslint-plugin-escompat/-/eslint-plugin-escompat-3.11.4.tgz",
@@ -7470,6 +7575,19 @@
"eslint": "^8 || ^9"
}
},
+ "node_modules/eslint-plugin-github/node_modules/globals": {
+ "version": "16.5.0",
+ "resolved": "https://registry.npmjs.org/globals/-/globals-16.5.0.tgz",
+ "integrity": "sha512-c/c15i26VrJ4IRt5Z89DnIzCGDn9EcebibhAOjw5ibqEHsE1wLUgkPn9RDmNcUKyU87GeaL633nyJ+pplFR2ZQ==",
+ "dev": true,
+ "license": "MIT",
+ "engines": {
+ "node": ">=18"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
"node_modules/eslint-plugin-i18n-text": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/eslint-plugin-i18n-text/-/eslint-plugin-i18n-text-1.0.1.tgz",
@@ -7486,6 +7604,7 @@
"integrity": "sha512-whOE1HFo/qJDyX4SnXzP4N6zOWn79WhnCUY/iDR0mPfQZO8wcYE4JClzI2oZrhBnnMUCBCHZhO6VQyoBU95mZA==",
"dev": true,
"license": "MIT",
+ "peer": true,
"dependencies": {
"@rtsao/scc": "^1.1.0",
"array-includes": "^3.1.9",
@@ -8175,18 +8294,19 @@
}
},
"node_modules/express": {
- "version": "5.1.0",
- "resolved": "https://registry.npmjs.org/express/-/express-5.1.0.tgz",
- "integrity": "sha512-DT9ck5YIRU+8GYzzU5kT3eHGA5iL+1Zd0EutOmTE9Dtk+Tvuzd23VBU+ec7HPNSTxXYO55gPV/hq4pSBJDjFpA==",
+ "version": "5.2.0",
+ "resolved": "https://registry.npmjs.org/express/-/express-5.2.0.tgz",
+ "integrity": "sha512-XdpJDLxfztVY59X0zPI6sibRiGcxhTPXRD3IhJmjKf2jwMvkRGV1j7loB8U+heeamoU3XvihAaGRTR4aXXUN3A==",
"license": "MIT",
"dependencies": {
"accepts": "^2.0.0",
- "body-parser": "^2.2.0",
+ "body-parser": "^2.2.1",
"content-disposition": "^1.0.0",
"content-type": "^1.0.5",
"cookie": "^0.7.1",
"cookie-signature": "^1.2.1",
"debug": "^4.4.0",
+ "depd": "^2.0.0",
"encodeurl": "^2.0.0",
"escape-html": "^1.0.3",
"etag": "^1.8.1",
@@ -8428,6 +8548,23 @@
"node": ">= 0.8"
}
},
+ "node_modules/find-replace": {
+ "version": "5.0.2",
+ "resolved": "https://registry.npmjs.org/find-replace/-/find-replace-5.0.2.tgz",
+ "integrity": "sha512-Y45BAiE3mz2QsrN2fb5QEtO4qb44NcS7en/0y9PEVsg351HsLeVclP8QPMH79Le9sH3rs5RSwJu99W0WPZO43Q==",
+ "license": "MIT",
+ "engines": {
+ "node": ">=14"
+ },
+ "peerDependencies": {
+ "@75lb/nature": "latest"
+ },
+ "peerDependenciesMeta": {
+ "@75lb/nature": {
+ "optional": true
+ }
+ }
+ },
"node_modules/find-yarn-workspace-root": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/find-yarn-workspace-root/-/find-yarn-workspace-root-2.0.0.tgz",
@@ -8463,6 +8600,12 @@
"node": ">=16"
}
},
+ "node_modules/flatbuffers": {
+ "version": "25.9.23",
+ "resolved": "https://registry.npmjs.org/flatbuffers/-/flatbuffers-25.9.23.tgz",
+ "integrity": "sha512-MI1qs7Lo4Syw0EOzUl0xjs2lsoeqFku44KpngfIduHBYvzm8h2+7K8YMQh1JtVVVrUvhLpNwqVi4DERegUJhPQ==",
+ "license": "Apache-2.0"
+ },
"node_modules/flatted": {
"version": "3.3.3",
"resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
@@ -8512,11 +8655,12 @@
}
},
"node_modules/foreground-child": {
- "version": "3.1.1",
- "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.1.1.tgz",
- "integrity": "sha512-TMKDUnIte6bfb5nWv7V/caI169OHgvwjb7V4WkeUvbQQdjr5rWKqHFiKWb/fcOwB+CzBT+qbWjvj+DVwRskpIg==",
+ "version": "3.3.1",
+ "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
+ "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
+ "license": "ISC",
"dependencies": {
- "cross-spawn": "^7.0.0",
+ "cross-spawn": "^7.0.6",
"signal-exit": "^4.0.1"
},
"engines": {
@@ -8530,6 +8674,7 @@
"version": "4.1.0",
"resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
"integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+ "license": "ISC",
"engines": {
"node": ">=14"
},
@@ -8655,7 +8800,6 @@
"node_modules/gensync": {
"version": "1.0.0-beta.2",
"license": "MIT",
- "peer": true,
"engines": {
"node": ">=6.9.0"
}
@@ -8755,14 +8899,14 @@
"license": "ISC"
},
"node_modules/glob": {
- "version": "11.0.2",
- "resolved": "https://registry.npmjs.org/glob/-/glob-11.0.2.tgz",
- "integrity": "sha512-YT7U7Vye+t5fZ/QMkBFrTJ7ZQxInIUjwyAjVj84CYXqgBdv30MFUPGnBR6sQaVq6Is15wYJUsnzTuWaGRBhBAQ==",
- "license": "ISC",
+ "version": "11.1.0",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-11.1.0.tgz",
+ "integrity": "sha512-vuNwKSaKiqm7g0THUBu2x7ckSs3XJLXE+2ssL7/MfTGPLLcrJQ/4Uq1CjPTtO5cCIiRxqvN6Twy1qOwhL0Xjcw==",
+ "license": "BlueOak-1.0.0",
"dependencies": {
- "foreground-child": "^3.1.0",
- "jackspeak": "^4.0.1",
- "minimatch": "^10.0.0",
+ "foreground-child": "^3.3.1",
+ "jackspeak": "^4.1.1",
+ "minimatch": "^10.1.1",
"minipass": "^7.1.2",
"package-json-from-dist": "^1.0.0",
"path-scurry": "^2.0.0"
@@ -8789,11 +8933,12 @@
}
},
"node_modules/glob/node_modules/minimatch": {
- "version": "10.0.1",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.0.1.tgz",
- "integrity": "sha512-ethXTt3SGGR+95gudmqJ1eNhRO7eGEGIgYA9vnPatK4/etz2MEVDno5GMCibdMTuBMyElzIlgxMna3K94XDIDQ==",
+ "version": "10.1.1",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.1.tgz",
+ "integrity": "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==",
+ "license": "BlueOak-1.0.0",
"dependencies": {
- "brace-expansion": "^2.0.1"
+ "@isaacs/brace-expansion": "^5.0.0"
},
"engines": {
"node": "20 || >=22"
@@ -8803,9 +8948,9 @@
}
},
"node_modules/globals": {
- "version": "16.3.0",
- "resolved": "https://registry.npmjs.org/globals/-/globals-16.3.0.tgz",
- "integrity": "sha512-bqWEnJ1Nt3neqx2q5SFfGS8r/ahumIakg3HcwtNlrVlwXIeNumWn/c7Pn/wKzGhf6SaW6H6uWXLqC30STCMchQ==",
+ "version": "17.0.0",
+ "resolved": "https://registry.npmjs.org/globals/-/globals-17.0.0.tgz",
+ "integrity": "sha512-gv5BeD2EssA793rlFWVPMMCqefTlpusw6/2TbAVMy0FzcG8wKJn4O+NqJ4+XWmmwrayJgw5TzrmWjFgmz1XPqw==",
"dev": true,
"license": "MIT",
"engines": {
@@ -8861,6 +9006,7 @@
"resolved": "https://registry.npmjs.org/graphql/-/graphql-16.9.0.tgz",
"integrity": "sha512-GGTKBX4SD7Wdb8mqeDLni2oaRGYQWjWHGKPQ24ZMnUtKfcsVoiv4uX8+LJr1K6U5VW2Lu1BwJnj7uiori0YtRw==",
"dev": true,
+ "peer": true,
"engines": {
"node": "^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0"
}
@@ -8880,7 +9026,6 @@
},
"node_modules/has-flag": {
"version": "4.0.0",
- "dev": true,
"license": "MIT",
"engines": {
"node": ">=8"
@@ -9242,11 +9387,12 @@
"license": "MIT"
},
"node_modules/hot-shots": {
- "version": "11.1.0",
- "resolved": "https://registry.npmjs.org/hot-shots/-/hot-shots-11.1.0.tgz",
- "integrity": "sha512-D4iAs/145g7EJ/wIzBLVANEpysTPthUy/K+4EUIw02YJQTqvzD1vUpYiM3vwR0qPAQj4FhQpQz8wBpY8KDcM0g==",
+ "version": "13.1.0",
+ "resolved": "https://registry.npmjs.org/hot-shots/-/hot-shots-13.1.0.tgz",
+ "integrity": "sha512-dvLYrOSh4dZknxpsVM3nSiXZfipGDLIPtS7Ad2KSaM/oUFOIOeKg0T1Rp0KwVGP9u2e3eW4wvjbta2bNwkHU/g==",
+ "license": "MIT",
"engines": {
- "node": ">=10.0.0"
+ "node": ">=16.0.0"
},
"optionalDependencies": {
"unix-dgram": "2.x"
@@ -9256,6 +9402,7 @@
"version": "1.2.0",
"resolved": "https://registry.npmjs.org/hpagent/-/hpagent-1.2.0.tgz",
"integrity": "sha512-A91dYTeIB6NoXG+PxTQpCCDDnfHsW9kc06Lvpu1TEe9gnd6ZFeiBoRO9JvzEv6xK7EX97/dUE8g/vBMTqTS3CA==",
+ "license": "MIT",
"engines": {
"node": ">=14"
}
@@ -9343,28 +9490,23 @@
"license": "BSD-2-Clause"
},
"node_modules/http-errors": {
- "version": "2.0.0",
- "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.0.tgz",
- "integrity": "sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==",
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+ "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
"license": "MIT",
"dependencies": {
- "depd": "2.0.0",
- "inherits": "2.0.4",
- "setprototypeof": "1.2.0",
- "statuses": "2.0.1",
- "toidentifier": "1.0.1"
+ "depd": "~2.0.0",
+ "inherits": "~2.0.4",
+ "setprototypeof": "~1.2.0",
+ "statuses": "~2.0.2",
+ "toidentifier": "~1.0.1"
},
"engines": {
"node": ">= 0.8"
- }
- },
- "node_modules/http-errors/node_modules/statuses": {
- "version": "2.0.1",
- "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz",
- "integrity": "sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==",
- "license": "MIT",
- "engines": {
- "node": ">= 0.8"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/express"
}
},
"node_modules/http-proxy": {
@@ -9494,15 +9636,19 @@
}
},
"node_modules/iconv-lite": {
- "version": "0.6.3",
- "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
- "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+ "version": "0.7.0",
+ "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.0.tgz",
+ "integrity": "sha512-cf6L2Ds3h57VVmkZe+Pn+5APsT7FpqJtEhhieDCvrE2MK5Qk9MyffgQyuxQTm6BChfeZNtcOLHp9IcWRVcIcBQ==",
"license": "MIT",
"dependencies": {
"safer-buffer": ">= 2.1.2 < 3.0.0"
},
"engines": {
"node": ">=0.10.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/express"
}
},
"node_modules/ieee754": {
@@ -10210,9 +10356,10 @@
"license": "ISC"
},
"node_modules/jackspeak": {
- "version": "4.0.1",
- "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-4.0.1.tgz",
- "integrity": "sha512-cub8rahkh0Q/bw1+GxP7aeSe29hHHn2V4m29nnDlvCdlgU+3UGxkZp7Z53jLUdpX3jdTO0nJZUDl3xvbWc2Xog==",
+ "version": "4.1.1",
+ "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-4.1.1.tgz",
+ "integrity": "sha512-zptv57P3GpL+O0I7VdMJNBZCu+BPHVQUk55Ft8/QCJjTVxrnJHuVuX/0Bl2A6/+2oyR/ZMEuFKwmzqqZ/U5nPQ==",
+ "license": "BlueOak-1.0.0",
"dependencies": {
"@isaacs/cliui": "^8.0.2"
},
@@ -10221,9 +10368,6 @@
},
"funding": {
"url": "https://github.com/sponsors/isaacs"
- },
- "optionalDependencies": {
- "@pkgjs/parseargs": "^0.11.0"
}
},
"node_modules/javascript-stringify": {
@@ -10235,6 +10379,7 @@
"resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
"integrity": "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==",
"dev": true,
+ "peer": true,
"bin": {
"jiti": "lib/jiti-cli.mjs"
}
@@ -10267,7 +10412,9 @@
"license": "MIT"
},
"node_modules/js-yaml": {
- "version": "4.1.0",
+ "version": "4.1.1",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+ "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
"license": "MIT",
"dependencies": {
"argparse": "^2.0.1"
@@ -10286,6 +10433,14 @@
"node": ">=4"
}
},
+ "node_modules/json-bignum": {
+ "version": "0.0.3",
+ "resolved": "https://registry.npmjs.org/json-bignum/-/json-bignum-0.0.3.tgz",
+ "integrity": "sha512-2WHyXj3OfHSgNyuzDbSxI1w2jgw5gkWSWhS7Qg4bWXx1nLk3jnbwfUeS0PSba3IzpTUWdHxBieELUzXRjQB2zg==",
+ "engines": {
+ "node": ">=0.8"
+ }
+ },
"node_modules/json-buffer": {
"version": "3.0.1",
"dev": true,
@@ -10351,7 +10506,6 @@
"node_modules/json5": {
"version": "2.2.3",
"license": "MIT",
- "peer": true,
"bin": {
"json5": "lib/cli.js"
},
@@ -10427,11 +10581,12 @@
}
},
"node_modules/jws": {
- "version": "3.2.2",
- "resolved": "https://registry.npmjs.org/jws/-/jws-3.2.2.tgz",
- "integrity": "sha512-YHlZCB6lMTllWDtSPHz/ZXTsi8S00usEV6v1tjq8tOUZzw7DpSDWVXjXDre6ed1w/pd495ODpHZYSdkRTsa0HA==",
+ "version": "3.2.3",
+ "resolved": "https://registry.npmjs.org/jws/-/jws-3.2.3.tgz",
+ "integrity": "sha512-byiJ0FLRdLdSVSReO/U4E7RoEyOCKnEnEPMjq3HxWtvzLsV08/i5RQKsFVNkCldrCaPr2vDNAOMsfs8T/Hze7g==",
+ "license": "MIT",
"dependencies": {
- "jwa": "^1.4.1",
+ "jwa": "^1.4.2",
"safe-buffer": "^5.0.1"
}
},
@@ -10610,18 +10765,21 @@
"dev": true
},
"node_modules/lodash": {
- "version": "4.17.21",
+ "version": "4.17.23",
+ "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+ "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
"license": "MIT"
},
"node_modules/lodash-es": {
- "version": "4.17.21",
+ "version": "4.17.23",
+ "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.23.tgz",
+ "integrity": "sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg==",
"license": "MIT"
},
"node_modules/lodash.camelcase": {
"version": "4.3.0",
"resolved": "https://registry.npmjs.org/lodash.camelcase/-/lodash.camelcase-4.3.0.tgz",
"integrity": "sha512-TwuEnCnxbc3rAvhf/LbG7tJUDzhqXyFnv3dtzLOPgCG/hODL7WFnsbwktkD7yUV0RrreP/l1PALq/YSg6VvjlA==",
- "dev": true,
"license": "MIT"
},
"node_modules/lodash.includes": {
@@ -11261,9 +11419,10 @@
}
},
"node_modules/mdast-util-to-hast": {
- "version": "13.2.0",
- "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.0.tgz",
- "integrity": "sha512-QGYKEuUsYT9ykKBCMOEDLsU5JRObWQusAolFMeko/tYPufNkRffBAQjIE+99jbA87xv6FgmjLtwjh9wBWajwAA==",
+ "version": "13.2.1",
+ "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
+ "integrity": "sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA==",
+ "license": "MIT",
"dependencies": {
"@types/hast": "^3.0.0",
"@types/mdast": "^4.0.0",
@@ -12079,13 +12238,14 @@
}
},
"node_modules/next": {
- "version": "16.0.1",
- "resolved": "https://registry.npmjs.org/next/-/next-16.0.1.tgz",
- "integrity": "sha512-e9RLSssZwd35p7/vOa+hoDFggUZIUbZhIUSLZuETCwrCVvxOs87NamoUzT+vbcNAL8Ld9GobBnWOA6SbV/arOw==",
+ "version": "16.1.5",
+ "resolved": "https://registry.npmjs.org/next/-/next-16.1.5.tgz",
+ "integrity": "sha512-f+wE+NSbiQgh3DSAlTaw2FwY5yGdVViAtp8TotNQj4kk4Q8Bh1sC/aL9aH+Rg1YAVn18OYXsRDT7U/079jgP7w==",
"license": "MIT",
"dependencies": {
- "@next/env": "16.0.1",
+ "@next/env": "16.1.5",
"@swc/helpers": "0.5.15",
+ "baseline-browser-mapping": "^2.8.3",
"caniuse-lite": "^1.0.30001579",
"postcss": "8.4.31",
"styled-jsx": "5.1.6"
@@ -12097,14 +12257,14 @@
"node": ">=20.9.0"
},
"optionalDependencies": {
- "@next/swc-darwin-arm64": "16.0.1",
- "@next/swc-darwin-x64": "16.0.1",
- "@next/swc-linux-arm64-gnu": "16.0.1",
- "@next/swc-linux-arm64-musl": "16.0.1",
- "@next/swc-linux-x64-gnu": "16.0.1",
- "@next/swc-linux-x64-musl": "16.0.1",
- "@next/swc-win32-arm64-msvc": "16.0.1",
- "@next/swc-win32-x64-msvc": "16.0.1",
+ "@next/swc-darwin-arm64": "16.1.5",
+ "@next/swc-darwin-x64": "16.1.5",
+ "@next/swc-linux-arm64-gnu": "16.1.5",
+ "@next/swc-linux-arm64-musl": "16.1.5",
+ "@next/swc-linux-x64-gnu": "16.1.5",
+ "@next/swc-linux-x64-musl": "16.1.5",
+ "@next/swc-win32-arm64-msvc": "16.1.5",
+ "@next/swc-win32-x64-msvc": "16.1.5",
"sharp": "^0.34.4"
},
"peerDependencies": {
@@ -12692,10 +12852,14 @@
}
},
"node_modules/object-inspect": {
- "version": "1.13.1",
- "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.1.tgz",
- "integrity": "sha512-5qoj1RUiKOMsCCNLV1CBiPYE10sziTsnmNxkAI/rZhiD63CF7IqdFGC/XzjWjpSgLf0LxXX3bDFIh0E18f6UhQ==",
+ "version": "1.13.2",
+ "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.2.tgz",
+ "integrity": "sha512-IRZSRuzJiynemAXPYtPe5BoI/RESNYR7TYm50MC5Mqbd3Jmw5y790sErYw3V6SryFJD64b74qQQs9wn5Bg/k3g==",
"dev": true,
+ "license": "MIT",
+ "engines": {
+ "node": ">= 0.4"
+ },
"funding": {
"url": "https://github.com/sponsors/ljharb"
}
@@ -13304,6 +13468,7 @@
"integrity": "sha512-hutraynyn31F+Bifme+Ps9Vq59hKuUCz7H1kDOcBs+2oGguKkWTU50bBWrtz34OUWmIwpBTWDxaRPXrIXkgvmQ==",
"devOptional": true,
"license": "Apache-2.0",
+ "peer": true,
"bin": {
"playwright-core": "cli.js"
},
@@ -13367,6 +13532,7 @@
"integrity": "sha512-QQtaxnoDJeAkDvDKWCLiwIXkTgRhwYDEQCghU9Z6q03iyek/rxRh/2lC3HB7P8sWT2xC/y5JDctPLBIGzHKbhw==",
"dev": true,
"license": "MIT",
+ "peer": true,
"bin": {
"prettier": "bin/prettier.cjs"
},
@@ -13461,9 +13627,9 @@
}
},
"node_modules/qs": {
- "version": "6.14.0",
- "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.0.tgz",
- "integrity": "sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==",
+ "version": "6.14.1",
+ "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.1.tgz",
+ "integrity": "sha512-4EK3+xJl8Ts67nLYNwqw/dsFVnCf+qR7RgXSK9jEEm9unao3njwMDdmsdvoKBKHzxd7tCYz5e5M+SnMjdtXGQQ==",
"license": "BSD-3-Clause",
"dependencies": {
"side-channel": "^1.1.0"
@@ -13518,24 +13684,25 @@
}
},
"node_modules/raw-body": {
- "version": "3.0.0",
- "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.0.tgz",
- "integrity": "sha512-RmkhL8CAyCRPXCE28MMH0z2PNWQBNk2Q09ZdxM9IOOXwxwZbN+qbWaatPkdkWIKL2ZVDImrN/pK5HTRz2PcS4g==",
+ "version": "3.0.2",
+ "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
+ "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
"license": "MIT",
"dependencies": {
- "bytes": "3.1.2",
- "http-errors": "2.0.0",
- "iconv-lite": "0.6.3",
- "unpipe": "1.0.0"
+ "bytes": "~3.1.2",
+ "http-errors": "~2.0.1",
+ "iconv-lite": "~0.7.0",
+ "unpipe": "~1.0.0"
},
"engines": {
- "node": ">= 0.8"
+ "node": ">= 0.10"
}
},
"node_modules/react": {
"version": "18.3.1",
"resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
"integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
+ "peer": true,
"dependencies": {
"loose-envify": "^1.1.0"
},
@@ -13556,6 +13723,7 @@
"version": "18.3.1",
"resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
"integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
+ "peer": true,
"dependencies": {
"loose-envify": "^1.1.0",
"scheduler": "^0.23.2"
@@ -14223,6 +14391,7 @@
"integrity": "sha512-d0NoFH4v6SjEK7BoX810Jsrhj7IQSYHAHLi/iSpgqKc7LaIDshFRlSg5LOymf9FqQhxEHs2W5ZQXlvy0KD45Uw==",
"devOptional": true,
"license": "MIT",
+ "peer": true,
"dependencies": {
"chokidar": "^4.0.0",
"immutable": "^5.0.2",
@@ -14297,9 +14466,20 @@
}
},
"node_modules/secure-json-parse": {
- "version": "2.7.0",
- "resolved": "https://registry.npmjs.org/secure-json-parse/-/secure-json-parse-2.7.0.tgz",
- "integrity": "sha512-6aU+Rwsezw7VR8/nyvKTx8QpWH9FrcYiXXlqC4z5d5XQBDRqtbfsRjnwGyqbi3gddNtWHuEk9OANUotL26qKUw=="
+ "version": "3.0.2",
+ "resolved": "https://registry.npmjs.org/secure-json-parse/-/secure-json-parse-3.0.2.tgz",
+ "integrity": "sha512-H6nS2o8bWfpFEV6U38sOSjS7bTbdgbCGU9wEM6W14P5H0QOsz94KCusifV44GpHDTu2nqZbuDNhTzu+mjDSw1w==",
+ "funding": [
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/fastify"
+ },
+ {
+ "type": "opencollective",
+ "url": "https://opencollective.com/fastify"
+ }
+ ],
+ "license": "BSD-3-Clause"
},
"node_modules/semver": {
"version": "7.7.2",
@@ -14915,6 +15095,7 @@
"version": "4.2.3",
"resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
"integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+ "license": "MIT",
"dependencies": {
"emoji-regex": "^8.0.0",
"is-fullwidth-code-point": "^3.0.0",
@@ -14927,12 +15108,14 @@
"node_modules/string-width-cjs/node_modules/emoji-regex": {
"version": "8.0.0",
"resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
- "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="
+ "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+ "license": "MIT"
},
"node_modules/string-width-cjs/node_modules/strip-ansi": {
"version": "6.0.1",
"resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
"integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+ "license": "MIT",
"dependencies": {
"ansi-regex": "^5.0.1"
},
@@ -15059,6 +15242,7 @@
"version": "6.0.1",
"resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
"integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+ "license": "MIT",
"dependencies": {
"ansi-regex": "^5.0.1"
},
@@ -15145,6 +15329,7 @@
"resolved": "https://registry.npmjs.org/styled-components/-/styled-components-5.3.11.tgz",
"integrity": "sha512-uuzIIfnVkagcVHv9nE0VPlHPSCmXIUGKfJ42LNjxCCTDTL5sgnJ8Z7GZBq0EnLYGln77tPpEpExt2+qa+cZqSw==",
"license": "MIT",
+ "peer": true,
"dependencies": {
"@babel/helper-module-imports": "^7.0.0",
"@babel/traverse": "^7.4.5",
@@ -15232,7 +15417,6 @@
},
"node_modules/supports-color": {
"version": "7.2.0",
- "dev": true,
"license": "MIT",
"dependencies": {
"has-flag": "^4.0.0"
@@ -15294,6 +15478,19 @@
"url": "https://opencollective.com/synckit"
}
},
+ "node_modules/table-layout": {
+ "version": "4.1.1",
+ "resolved": "https://registry.npmjs.org/table-layout/-/table-layout-4.1.1.tgz",
+ "integrity": "sha512-iK5/YhZxq5GO5z8wb0bY1317uDF3Zjpha0QFFLA8/trAoiLbQD0HUbMesEaxyzUgDxi2QlcbM8IvqOlEjgoXBA==",
+ "license": "MIT",
+ "dependencies": {
+ "array-back": "^6.2.2",
+ "wordwrapjs": "^5.1.0"
+ },
+ "engines": {
+ "node": ">=12.17"
+ }
+ },
"node_modules/tcp-port-used": {
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/tcp-port-used/-/tcp-port-used-1.0.2.tgz",
@@ -15391,6 +15588,7 @@
"integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
"dev": true,
"license": "MIT",
+ "peer": true,
"engines": {
"node": ">=12"
},
@@ -15716,6 +15914,7 @@
"integrity": "sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ==",
"dev": true,
"license": "Apache-2.0",
+ "peer": true,
"bin": {
"tsc": "bin/tsc",
"tsserver": "bin/tsserver"
@@ -15748,6 +15947,15 @@
"typescript": ">=4.8.4 <6.0.0"
}
},
+ "node_modules/typical": {
+ "version": "7.3.0",
+ "resolved": "https://registry.npmjs.org/typical/-/typical-7.3.0.tgz",
+ "integrity": "sha512-ya4mg/30vm+DOWfBg4YK3j2WD6TWtRkCbasOJr40CseYENzCUby/7rIvXA99JGsQHeNxLbnXdyLLxKSv3tauFw==",
+ "license": "MIT",
+ "engines": {
+ "node": ">=12.17"
+ }
+ },
"node_modules/uc.micro": {
"version": "2.1.0",
"resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-2.1.0.tgz",
@@ -15791,14 +15999,12 @@
"license": "MIT"
},
"node_modules/undici": {
- "version": "5.29.0",
- "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
- "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
- "dependencies": {
- "@fastify/busboy": "^2.0.0"
- },
+ "version": "6.23.0",
+ "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+ "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+ "license": "MIT",
"engines": {
- "node": ">=14.0"
+ "node": ">=18.17"
}
},
"node_modules/undici-types": {
@@ -16063,6 +16269,7 @@
"dev": true,
"hasInstallScript": true,
"license": "MIT",
+ "peer": true,
"dependencies": {
"napi-postinstall": "^0.2.2"
},
@@ -16265,6 +16472,7 @@
"integrity": "sha512-ZWyE8YXEXqJrrSLvYgrRP7p62OziLW7xI5HYGWFzOvupfAlrLvURSzv/FyGyy0eidogEM3ujU+kUG1zuHgb6Ug==",
"dev": true,
"license": "MIT",
+ "peer": true,
"dependencies": {
"esbuild": "^0.25.0",
"fdir": "^6.5.0",
@@ -16373,6 +16581,7 @@
"integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
"dev": true,
"license": "MIT",
+ "peer": true,
"engines": {
"node": ">=12"
},
@@ -16797,6 +17006,15 @@
"url": "https://github.com/sponsors/sindresorhus"
}
},
+ "node_modules/wordwrapjs": {
+ "version": "5.1.1",
+ "resolved": "https://registry.npmjs.org/wordwrapjs/-/wordwrapjs-5.1.1.tgz",
+ "integrity": "sha512-0yweIbkINJodk27gX9LBGMzyQdBDan3s/dEAiwBOj+Mf0PPyWL6/rikalkv8EeD0E8jm4o5RXEOrFTP3NXbhJg==",
+ "license": "MIT",
+ "engines": {
+ "node": ">=12.17"
+ }
+ },
"node_modules/wrap-ansi": {
"version": "9.0.0",
"resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-9.0.0.tgz",
@@ -16818,6 +17036,7 @@
"version": "7.0.0",
"resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
"integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+ "license": "MIT",
"dependencies": {
"ansi-styles": "^4.0.0",
"string-width": "^4.1.0",
@@ -16834,6 +17053,7 @@
"version": "6.0.1",
"resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
"integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+ "license": "MIT",
"dependencies": {
"ansi-regex": "^5.0.1"
},
@@ -16947,6 +17167,15 @@
"type": "github",
"url": "https://github.com/sponsors/wooorm"
}
+ },
+ "src/eslint-rules": {
+ "name": "eslint-plugin-custom-rules",
+ "version": "1.0.0",
+ "dev": true,
+ "license": "MIT",
+ "peerDependencies": {
+ "eslint": "^8.0.0 || ^9.0.0"
+ }
}
}
}
diff --git a/package.json b/package.json
index b28b2e83324e..791b0d4e8fd7 100644
--- a/package.json
+++ b/package.json
@@ -21,7 +21,6 @@
"check-github-github-links": "tsx src/links/scripts/check-github-github-links.ts",
"clone-early-access": "./src/early-access/scripts/clone-locally",
"clone-translations": "./src/languages/scripts/clone-translations.sh",
- "cmp-files": "tsx src/workflows/cmp-files.ts",
"content-changes-table-comment": "tsx src/workflows/content-changes-table-comment.ts",
"copy-fixture-data": "tsx src/tests/scripts/copy-fixture-data.ts",
"count-translation-corruptions": "cross-env NODE_OPTIONS=--max-old-space-size=8192 tsx src/languages/scripts/count-translation-corruptions.ts",
@@ -31,7 +30,7 @@
"debug": "cross-env NODE_ENV=development ENABLED_LANGUAGES=en nodemon --inspect src/frame/server.ts",
"delete-orphan-translation-files": "tsx src/workflows/delete-orphan-translation-files.ts",
"docsaudit": "tsx src/metrics/scripts/docsaudit.ts",
- "docstat": "tsx src/metrics/scripts/docstat.ts",
+ "docstat": "tsx --disable-warning=DEP0190 src/metrics/scripts/docstat.ts",
"deleted-assets-pr-comment": "tsx src/assets/scripts/deleted-assets-pr-comment.ts",
"deleted-features-pr-comment": "tsx src/data-directory/scripts/deleted-features-pr-comment.ts",
"deprecate-ghes": "tsx src/ghes-releases/scripts/deprecate/index.ts",
@@ -60,13 +59,14 @@
"lint-translation": "vitest src/content-linter/tests/lint-files.ts",
"liquid-markdown-tables": "tsx src/tools/scripts/liquid-markdown-tables/index.ts",
"generate-article-api-docs": "tsx src/article-api/scripts/generate-api-docs.ts",
- "generate-code-scanning-query-list": "tsx src/code-scanning/scripts/generate-code-scanning-query-list.ts",
+ "generate-code-scanning-query-list": "tsx src/codeql-queries/scripts/generate-code-scanning-query-list.ts",
+ "generate-code-quality-query-list": "tsx src/codeql-queries/scripts/generate-code-quality-query-list.ts",
"generate-content-linter-docs": "tsx src/content-linter/scripts/generate-docs.ts",
"move-content": "tsx src/content-render/scripts/move-content.ts",
+ "move-by-content-type": "tsx src/content-render/scripts/move-by-content-type.ts",
"openapi-docs": "tsx src/rest/docs.ts",
"playwright-test": "playwright test --config src/fixtures/playwright.config.ts --project=\"Google Chrome\"",
"lint-report": "tsx src/content-linter/scripts/lint-report.ts",
- "postinstall": "cp package-lock.json .installed.package-lock.json && echo \"Updated .installed.package-lock.json\" # see husky/post-checkout and husky/post-merge",
"precompute-pageinfo": "tsx src/article-api/scripts/precompute-pageinfo.ts",
"prepare": "husky src/workflows/husky",
"prettier": "prettier -w \"**/*.{ts,tsx,scss,yml,yaml}\"",
@@ -79,8 +79,10 @@
"release-banner": "tsx src/ghes-releases/scripts/release-banner.ts",
"repo-sync": "./src/workflows/local-repo-sync.sh",
"reusables": "tsx src/content-render/scripts/reusables-cli.ts",
- "rendered-content-link-checker": "tsx src/links/scripts/rendered-content-link-checker.ts",
- "rendered-content-link-checker-cli": "tsx src/links/scripts/rendered-content-link-checker-cli.ts",
+ "liquid-tags": "tsx src/content-render/scripts/liquid-tags.ts",
+ "check-links-pr": "tsx src/links/scripts/check-links-pr.ts",
+ "check-links-internal": "tsx src/links/scripts/check-links-internal.ts",
+ "check-links-external": "tsx src/links/scripts/check-links-external.ts",
"rest-dev": "tsx src/rest/scripts/update-files.ts",
"show-action-deps": "echo 'Action Dependencies:' && rg '^[\\s|-]*(uses:.*)$' .github -I -N --no-heading -r '$1$2' | sort | uniq | cut -c 7-",
"start": "cross-env NODE_ENV=development ENABLED_LANGUAGES=en nodemon src/frame/server.ts",
@@ -114,7 +116,7 @@
},
"nodemonConfig": {
"ext": "ts,json,yml,md,html,scss",
- "exec": "tsx",
+ "exec": "tsx --import ./src/observability/lib/handle-package-not-found.ts",
"ignore": [
"assets",
"script",
@@ -153,10 +155,12 @@
]
},
"dependencies": {
- "@elastic/elasticsearch": "8.13.1",
+ "@elastic/elasticsearch": "8.19.1",
"@github/failbot": "0.8.3",
+ "@github/hydro-analytics-client": "^2.3.3",
"@gr2m/gray-matter": "4.0.3-with-pr-137",
"@horizon-rs/language-guesser": "0.1.1",
+ "@octokit/graphql": "9.0.1",
"@octokit/plugin-retry": "8.0.1",
"@octokit/request-error": "7.0.0",
"@primer/behaviors": "^1.7.2",
@@ -164,6 +168,7 @@
"@primer/live-region-element": "^0.7.2",
"@primer/octicons": "^19.19.0",
"@primer/octicons-react": "^19.14.0",
+ "@primer/primitives": "^11.3.1",
"@primer/react": "^38.0.0",
"accept-language-parser": "^1.5.0",
"ajv": "^8.17.1",
@@ -183,37 +188,37 @@
"dereference-json-schema": "^0.2.1",
"dotenv": "^17.0.1",
"escape-string-regexp": "5.0.0",
- "express": "^5.1.0",
+ "express": "^5.2.0",
"fastest-levenshtein": "1.0.16",
"file-type": "21.0.0",
"flat": "^6.0.1",
"github-slugger": "^2.0.0",
- "glob": "11.0.2",
+ "glob": "11.1.0",
"hast-util-from-parse5": "^8.0.3",
"hast-util-to-string": "^3.0.1",
"hastscript": "^9.0.1",
"helmet": "^8.0.0",
"highlight.js": "^11.11.1",
"highlightjs-curl": "^1.3.0",
- "hot-shots": "^11.1.0",
+ "hot-shots": "^13.1.0",
"html-entities": "^2.5.6",
"http-proxy-middleware": "^3.0.5",
"imurmurhash": "^0.1.4",
"is-svg": "6.0.0",
"javascript-stringify": "^2.1.0",
"js-cookie": "^3.0.5",
- "js-yaml": "^4.1.0",
+ "js-yaml": "^4.1.1",
"liquidjs": "^10.16.7",
- "lodash": "^4.17.21",
- "lodash-es": "^4.17.21",
+ "lodash": "^4.17.23",
+ "lodash-es": "^4.17.23",
"lowdb": "7.0.1",
"lowlight": "^3.3.0",
"markdownlint-rule-helpers": "^0.25.0",
"mdast-util-from-markdown": "^2.0.2",
- "mdast-util-to-hast": "^13.2.0",
+ "mdast-util-to-hast": "^13.2.1",
"mdast-util-to-markdown": "2.1.2",
"mdast-util-to-string": "^4.0.0",
- "next": "^16.0.1",
+ "next": "^16.1.5",
"ora": "^9.0.0",
"parse5": "7.1.2",
"quick-lru": "7.0.1",
@@ -247,12 +252,12 @@
"walk-sync": "^4.0.1"
},
"devDependencies": {
- "@actions/core": "^1.10.1",
- "@actions/github": "^6.0.0",
+ "@actions/core": "^2.0.0",
+ "@actions/github": "^8.0.1",
"@axe-core/playwright": "^4.10.1",
"@eslint/js": "^9.33.0",
"@github/markdownlint-github": "^0.6.3",
- "@graphql-inspector/core": "^6.1.0",
+ "@graphql-inspector/core": "^7.0.3",
"@graphql-tools/load": "^8.0.19",
"@octokit/rest": "22.0.0",
"@playwright/test": "^1.56",
@@ -287,6 +292,7 @@
"eslint": "^9.33.0",
"eslint-config-prettier": "^10.1.8",
"eslint-import-resolver-typescript": "^4.4.2",
+ "eslint-plugin-custom-rules": "file:src/eslint-rules",
"eslint-plugin-escompat": "^3.11.4",
"eslint-plugin-eslint-comments": "^3.2.0",
"eslint-plugin-filenames": "^1.3.2",
@@ -298,7 +304,7 @@
"eslint-plugin-prettier": "^5.5.4",
"eslint-plugin-primer-react": "^8.0.0",
"event-to-promise": "^0.8.0",
- "globals": "^16.3.0",
+ "globals": "^17.0.0",
"graphql": "^16.9.0",
"http-status-code": "^2.1.0",
"husky": "^9.1.7",
diff --git a/src/ai-tools/README.md b/src/ai-tools/README.md
index b527174726c5..4c9d7ef7225f 100644
--- a/src/ai-tools/README.md
+++ b/src/ai-tools/README.md
@@ -1,56 +1,183 @@
# AI-powered tools
-A CLI tool for using AI to edit documentation according to defined prompts.
+The ai-tools subject provides CLI tools for using AI to edit and refine documentation based on prompt-driven guidelines. It integrates with GitHub Models API to apply automated improvements to content files.
-This tool refines content files using AI based on an (extensible) set of prompt-driven guidelines. The default is versioning refinement. In the future we might add: scannability, readability, style, technical accuracy.
+## Purpose & Scope
-This script calls the [Models API](https://docs.github.com/en/rest/models/inference?apiVersion=2022-11-28#run-an-inference-request). It requires a personal access token with Models scopes in your `.env` file.
+This subject is responsible for:
+- AI-powered content refinement (versioning, intro, etc.)
+- Prompt-driven content editing with LLMs
+- Integration with GitHub Models API
+- Copilot Spaces export and conversion to prompts
+- Automated content quality improvements
+- Extensible prompt system for different refinement types
-## Usage
+Current refinements: versioning, intro. Future: scannability, readability, style, technical accuracy.
-```sh
-<<<<<<< HEAD:src/ai-editors/README.md
-tsx src/ai-editors/scripts/ai-edit.ts --editor --response --files
-||||||| 5ae4ec0f5cb:src/ai-editors/README.md
-tsx src/ai-editors/scripts/ai-edit.js --editor --response --files
-=======
+## Architecture & Key Assets
+
+### Key capabilities and their locations
+
+- `scripts/ai-tools.ts` - Main CLI tool for running AI refinements
+- `lib/call-models-api.ts` - Client for GitHub Models API inference
+- `lib/prompt-utils.ts` - Loads prompts and executes refinements
+- `prompts/*.md` - Prompt templates for different refinement types
+
+## Setup & Usage
+
+### Requirements
+
+Add GitHub token with Models scopes to `.env`:
+
+```bash
+GITHUB_TOKEN=ghp_your_token_here
+```
+
+### Running refinements
+
+```bash
# Direct command
-tsx src/ai-tools/scripts/ai-tools.ts --refine --files
+tsx src/ai-tools/scripts/ai-tools.ts --refine versioning --files content/path/to/file.md
-# Or via npm script
-npm run ai-tools -- --refine --files
->>>>>>> origin/main:src/ai-tools/README.md
+# Via npm script
+npm run ai-tools -- --refine versioning --files content/path/to/file.md
```
-* `--files, -f`: One or more content file paths to process (required).
-* `--refine, -r`: Specify one or more refinement types (default: `versioning`).
+### Options
-**Examples:**
+- `--files, -f`: One or more content file paths (required)
+- `--refine, -r`: Refinement type(s) - `versioning`, `intro` (default: `versioning`)
+- `--write, -w`: Write changes to files (default: false, shows diff only)
+- `--verbose, -v`: Verbose output for debugging
+- `--space, -s`: Use Copilot Space as prompt
+- `--exportSpace`: Export Copilot Space to prompt file
-```sh
-<<<<<<< HEAD:src/ai-editors/README.md
-tsx src/ai-editors/scripts/ai-edit.ts --files content/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo.md --editor versioning --response list
-||||||| 5ae4ec0f5cb:src/ai-editors/README.md
-tsx src/ai-editors/scripts/ai-edit.js --files content/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo.md --editor versioning --response list
-=======
-# Direct command
-tsx src/ai-tools/scripts/ai-tools.ts --files content/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo.md --refine versioning
+### Examples
-# Via npm script
-npm run ai-tools -- --files content/copilot/tutorials/coding-agent/get-the-best-results.md --refine intro
->>>>>>> origin/main:src/ai-tools/README.md
+Refine versioning in a file:
+```bash
+npm run ai-tools -- --files content/copilot/tutorials/coding-agent/get-the-best-results.md --refine versioning
```
-## Requirements
+Refine intro:
+```bash
+npm run ai-tools -- --files content/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo.md --refine intro
+```
+
+Multiple files:
+```bash
+npm run ai-tools -- --files file1.md file2.md file3.md --refine versioning
+```
+
+Write changes (not just preview):
+```bash
+npm run ai-tools -- --files content/path/to/file.md --refine versioning --write
+```
+
+## Data & External Dependencies
+
+### Data inputs
+- Content markdown files with frontmatter
+- Prompt templates in `prompts/` directory
+- GitHub Models API for inference
+
+### Dependencies
+- GitHub Models API - Requires `GITHUB_TOKEN` with Models scopes
+- `commander` - CLI argument parsing
+- `dotenv` - Environment variable loading
+- Copilot Spaces (optional) - Can export/import prompts
+
+### Data outputs
+- Refined markdown content (preview or written to files)
+- Diffs showing proposed changes
+- Merged frontmatter updates
+
+## Cross-links & Ownership
+
+### Related subjects
+- [`src/content-render`](../content-render/README.md) - Content parsing and rendering
+- Content files in `content/` - Target of refinements
+
+### Internal documentation
+- [GitHub Models API docs](https://docs.github.com/en/rest/models/inference)
+- Copilot Spaces for prompt management
+
+### Ownership
+- Team: Docs Content (for use and development)
+- Note: These tools are for the docs-content team. We welcome them to use Copilot to support and develop these tools, but docs-engineering is largely hands off.
+
+## Current State & Next Steps
+
+### Available refinement types
+
+Current prompts:
+- `versioning` - Refines version-related content
+- `intro` - Improves article introductions
+
+Each prompt defines:
+- Instructions for the LLM
+- Expected output format
+- Quality criteria
+
+### Adding new refinements
+
+1. Create prompt file in `prompts/` (e.g., `readability.md`).
+2. Write prompt instructions and examples.
+3. Test with Models UI first.
+4. Use `--refine readability` to apply.
+
+Prompt template in `prompts/prompt-template.yml`.
+
+### Copilot Spaces integration
+
+Export Space to prompt:
+```bash
+npm run ai-tools -- --exportSpace space-id --output prompts/my-prompt.md
+```
+
+Use Space as prompt:
+```bash
+npm run ai-tools -- --space space-id --files content/path/to/file.md
+```
+
+### Known limitations
+- Requires GitHub token with Models scopes
+- API rate limits apply
+- Quality depends on prompt engineering
+- Currently manual execution (not in CI)
+- No automated testing/evals yet
+
+### Best practices
+
+**Prompt engineering:**
+- Test prompts in GitHub Models UI first
+- Include clear examples in prompts
+- Define expected output format
+- Iterate on prompts based on results
+
+**File selection:**
+- Start with single files to test
+- Use glob patterns for batch processing
+- Preview changes before writing
+
+**Quality assurance:**
+- Always review AI suggestions
+- Don't blindly accept all changes
+- Consider subject matter expertise needed
+- Test refined content for correctness
+
+### Troubleshooting
-* A valid `GITHUB_TOKEN` with Models scopes in your local `.env` file.
+**Missing token error:**
+Add `GITHUB_TOKEN` to `.env` with Models scopes.
-## Future development ideas
+**API errors:**
+- Check token permissions
+- Verify rate limits
+- Check Models API status
-* Add prompts to support all available editors.
-* Test prompts in Models UI and add evals to prevent regressions.
-* Enable running in CI.
-* Explore the new `llm` plugin for GitHub Models (see https://github.com/github/copilot-productivity/discussions/5937).
-* Add MCP for more comprehensive context.
-* Integrate with Copilot Edit mode in VS Code.
-* Add unit tests.
+**Poor refinement quality:**
+- Refine the prompt template
+- Add more examples
+- Test in Models UI first
+- Consider different model/parameters
diff --git a/src/ai-tools/lib/auth-utils.ts b/src/ai-tools/lib/auth-utils.ts
new file mode 100644
index 000000000000..9639c6fc35b0
--- /dev/null
+++ b/src/ai-tools/lib/auth-utils.ts
@@ -0,0 +1,25 @@
+import { execSync } from 'child_process'
+
+/**
+ * Ensure GitHub token is available, exiting process if not found
+ */
+export function ensureGitHubToken(): void {
+ if (!process.env.GITHUB_TOKEN) {
+ try {
+ const token = execSync('gh auth token', { encoding: 'utf8' }).trim()
+ if (token) {
+ process.env.GITHUB_TOKEN = token
+ return
+ }
+ } catch {
+ // gh CLI not available or not authenticated
+ }
+
+ console.warn(`š A token is needed to run this script. Please do one of the following and try again:
+
+1. Add a GITHUB_TOKEN to a local .env file.
+2. Install https://cli.github.com and authenticate via 'gh auth login'.
+ `)
+ process.exit(1)
+ }
+}
diff --git a/src/ai-tools/lib/call-models-api.ts b/src/ai-tools/lib/call-models-api.ts
index dda311baa04f..70e2a90b6f58 100644
--- a/src/ai-tools/lib/call-models-api.ts
+++ b/src/ai-tools/lib/call-models-api.ts
@@ -1,4 +1,6 @@
const modelsCompletionsEndpoint = 'https://models.github.ai/inference/chat/completions'
+const API_TIMEOUT_MS = 180000 // 3 minutes
+const DEFAULT_MODEL = 'openai/gpt-4o'
interface ChatMessage {
role: string
@@ -34,10 +36,30 @@ interface ChatCompletionResponse {
}
}
-export async function callModelsApi(promptWithContent: ChatCompletionRequest): Promise {
+export async function callModelsApi(
+ promptWithContent: ChatCompletionRequest,
+ verbose = false,
+): Promise {
let aiResponse: ChatCompletionChoice
+ // Set default model if none specified
+ if (!promptWithContent.model) {
+ promptWithContent.model = DEFAULT_MODEL
+ if (verbose) {
+ console.log(`ā ļø No model specified, using default: ${DEFAULT_MODEL}`)
+ }
+ }
+
try {
+ // Create an AbortController for timeout handling
+ const controller = new AbortController()
+ const timeoutId = setTimeout(() => controller.abort(), API_TIMEOUT_MS)
+
+ const startTime = Date.now()
+ if (verbose) {
+ console.log(`š Making API request to GitHub Models using ${promptWithContent.model}...`)
+ }
+
const response = await fetch(modelsCompletionsEndpoint, {
method: 'post',
body: JSON.stringify(promptWithContent),
@@ -45,16 +67,80 @@ export async function callModelsApi(promptWithContent: ChatCompletionRequest): P
'Content-Type': 'application/json',
Authorization: `Bearer ${process.env.GITHUB_TOKEN}`,
'X-GitHub-Api-Version': '2022-11-28',
- Accept: 'Accept: application/vnd.github+json',
+ Accept: 'application/vnd.github+json',
},
+ signal: controller.signal,
})
+ const fetchTime = Date.now() - startTime
+ if (verbose) {
+ console.log(`ā±ļø API response received in ${fetchTime}ms`)
+ }
+
+ clearTimeout(timeoutId)
+
+ if (!response.ok) {
+ let errorMessage = `HTTP error! status: ${response.status} - ${response.statusText}`
+
+ // Try to get more detailed error information
+ try {
+ const errorBody = await response.json()
+ if (errorBody.error && errorBody.error.message) {
+ errorMessage += ` - ${errorBody.error.message}`
+ }
+ } catch {
+ // If we can't parse error body, continue with basic error
+ }
+
+ // Add helpful hints for common errors
+ if (response.status === 401) {
+ errorMessage += ' (Check your GITHUB_TOKEN)'
+ } else if (response.status === 400) {
+ errorMessage += ' (This may be due to an invalid model or malformed request)'
+ } else if (response.status === 429) {
+ errorMessage += ' (Rate limit exceeded - try again later)'
+ }
+
+ throw new Error(errorMessage)
+ }
+
const data: ChatCompletionResponse = await response.json()
+
+ if (!data.choices || data.choices.length === 0) {
+ throw new Error('No response choices returned from API')
+ }
+
aiResponse = data.choices[0]
+
+ if (verbose) {
+ const totalTime = Date.now() - startTime
+ console.log(`ā
Total API call completed in ${totalTime}ms`)
+
+ if (data.usage) {
+ console.log(
+ `š Tokens: ${data.usage.prompt_tokens} prompt + ${data.usage.completion_tokens} completion = ${data.usage.total_tokens} total`,
+ )
+ }
+ }
} catch (error) {
- console.error('Error calling GitHub Models REST API')
+ if (error instanceof Error) {
+ if (error.name === 'AbortError') {
+ throw new Error(`API call timed out after ${API_TIMEOUT_MS / 1000} seconds`)
+ }
+ console.error('Error calling GitHub Models REST API:', error.message)
+ }
throw error
}
- return aiResponse.message.content
+ return cleanAIResponse(aiResponse.message.content)
+}
+
+// Helper function to clean up AI response content
+function cleanAIResponse(content: string): string {
+ // Remove markdown code blocks
+ return content
+ .replace(/^```[\w]*\n/gm, '') // Remove opening code blocks
+ .replace(/\n```$/gm, '') // Remove closing code blocks at end
+ .replace(/\n```\n/gm, '\n') // Remove standalone closing code blocks
+ .trim()
}
diff --git a/src/ai-tools/lib/file-utils.ts b/src/ai-tools/lib/file-utils.ts
new file mode 100644
index 000000000000..af8c0ef91224
--- /dev/null
+++ b/src/ai-tools/lib/file-utils.ts
@@ -0,0 +1,169 @@
+import fs from 'fs'
+import path from 'path'
+import yaml from 'js-yaml'
+import readFrontmatter from '@/frame/lib/read-frontmatter'
+import { schema } from '@/frame/lib/frontmatter'
+
+const MAX_DIRECTORY_DEPTH = 20
+
+/**
+ * Enhanced recursive markdown file finder with symlink, depth, and root path checks
+ */
+export function findMarkdownFiles(
+ dir: string,
+ rootDir: string,
+ depth: number = 0,
+ maxDepth: number = MAX_DIRECTORY_DEPTH,
+ visited: Set = new Set(),
+): string[] {
+ const markdownFiles: string[] = []
+ let realDir: string
+ try {
+ realDir = fs.realpathSync(dir)
+ } catch {
+ // If we can't resolve real path, skip this directory
+ return []
+ }
+ // Prevent escaping root directory
+ if (!realDir.startsWith(rootDir)) {
+ return []
+ }
+ // Prevent symlink loops
+ if (visited.has(realDir)) {
+ return []
+ }
+ visited.add(realDir)
+ // Prevent excessive depth
+ if (depth > maxDepth) {
+ return []
+ }
+ let entries: fs.Dirent[]
+ try {
+ entries = fs.readdirSync(realDir, { withFileTypes: true })
+ } catch {
+ // If we can't read directory, skip
+ return []
+ }
+ for (const entry of entries) {
+ const fullPath = path.join(realDir, entry.name)
+ let realFullPath: string
+ try {
+ realFullPath = fs.realpathSync(fullPath)
+ } catch {
+ continue
+ }
+ // Prevent escaping root directory for files
+ if (!realFullPath.startsWith(rootDir)) {
+ continue
+ }
+ if (entry.isDirectory()) {
+ markdownFiles.push(...findMarkdownFiles(realFullPath, rootDir, depth + 1, maxDepth, visited))
+ } else if (entry.isFile() && entry.name.endsWith('.md')) {
+ markdownFiles.push(realFullPath)
+ }
+ }
+ return markdownFiles
+}
+
+interface FrontmatterProperties {
+ intro?: string
+ [key: string]: unknown
+}
+
+/**
+ * Function to merge new frontmatter properties into existing file while preserving formatting.
+ * Uses surgical replacement to only modify the specific field(s) being updated,
+ * preserving all original YAML formatting for unchanged fields.
+ */
+export function mergeFrontmatterProperties(filePath: string, newPropertiesYaml: string): string {
+ const content = fs.readFileSync(filePath, 'utf8')
+ const parsed = readFrontmatter(content)
+
+ if (parsed.errors && parsed.errors.length > 0) {
+ throw new Error(
+ `Failed to parse frontmatter: ${parsed.errors.map((e) => e.message).join(', ')}`,
+ )
+ }
+
+ if (parsed.content === undefined || parsed.content === null) {
+ throw new Error('Failed to parse content from file')
+ }
+
+ try {
+ // Clean up the AI response - remove markdown code blocks if present
+ let cleanedYaml = newPropertiesYaml.trim()
+ cleanedYaml = cleanedYaml.replace(/^```ya?ml\s*\n/i, '')
+ cleanedYaml = cleanedYaml.replace(/\n```\s*$/i, '')
+ cleanedYaml = cleanedYaml.trim()
+
+ const newProperties = yaml.load(cleanedYaml) as FrontmatterProperties
+
+ // Security: Validate against prototype pollution using the official frontmatter schema
+ const allowedKeys = Object.keys(schema.properties)
+
+ const sanitizedProperties = Object.fromEntries(
+ Object.entries(newProperties).filter(([key]) => {
+ if (allowedKeys.includes(key)) {
+ return true
+ }
+ console.warn(`Filtered out potentially unsafe frontmatter key: ${key}`)
+ return false
+ }),
+ )
+
+ // Split content into lines for surgical replacement
+ const lines = content.split('\n')
+ let inFrontmatter = false
+ let frontmatterEndIndex = -1
+
+ // Find frontmatter boundaries
+ for (let i = 0; i < lines.length; i++) {
+ if (lines[i].trim() === '---') {
+ if (!inFrontmatter) {
+ inFrontmatter = true
+ } else {
+ frontmatterEndIndex = i
+ break
+ }
+ }
+ }
+
+ // Replace each field value while preserving everything else
+ for (const [key, value] of Object.entries(sanitizedProperties)) {
+ const formattedValue = typeof value === 'string' ? `'${value.replace(/'/g, "''")}'` : value
+
+ // Find the line with this field
+ let foundField = false
+ for (let i = 1; i < frontmatterEndIndex; i++) {
+ const line = lines[i]
+ if (line.startsWith(`${key}:`)) {
+ foundField = true
+ // Simple replacement: keep the field name and spacing, replace the value
+ const colonIndex = line.indexOf(':')
+ const leadingSpace = line.substring(colonIndex + 1, colonIndex + 2) // Usually a space
+ lines[i] = `${key}:${leadingSpace}${formattedValue}`
+
+ // Remove any continuation lines (multi-line values)
+ const j = i + 1
+ while (j < frontmatterEndIndex && lines[j].startsWith(' ')) {
+ lines.splice(j, 1)
+ frontmatterEndIndex--
+ }
+ break
+ }
+ }
+
+ // If field doesn't exist, add it before the closing ---
+ if (!foundField && frontmatterEndIndex > 0) {
+ lines.splice(frontmatterEndIndex, 0, `${key}: ${formattedValue}`)
+ frontmatterEndIndex++
+ }
+ }
+
+ return lines.join('\n')
+ } catch (error) {
+ console.error('Failed to parse AI response as YAML:')
+ console.error('Raw AI response:', JSON.stringify(newPropertiesYaml))
+ throw new Error(`Failed to parse new frontmatter properties: ${error}`)
+ }
+}
diff --git a/src/ai-tools/lib/prompt-utils.ts b/src/ai-tools/lib/prompt-utils.ts
new file mode 100644
index 000000000000..7e2fbd887a04
--- /dev/null
+++ b/src/ai-tools/lib/prompt-utils.ts
@@ -0,0 +1,174 @@
+import { fileURLToPath } from 'url'
+import fs from 'fs'
+import yaml from 'js-yaml'
+import path from 'path'
+import readFrontmatter from '@/frame/lib/read-frontmatter'
+import { callModelsApi } from '@/ai-tools/lib/call-models-api'
+
+export interface PromptMessage {
+ content: string
+ role: string
+}
+
+export interface PromptData {
+ messages: PromptMessage[]
+ model?: string
+ temperature?: number
+ max_tokens?: number
+}
+
+/**
+ * Get the prompts directory path
+ */
+export function getPromptsDir(): string {
+ const __dirname = path.dirname(fileURLToPath(import.meta.url))
+ return path.join(__dirname, '../prompts')
+}
+
+/**
+ * Dynamically discover available editor types from prompt files
+ */
+export function getAvailableEditorTypes(promptDir: string): string[] {
+ const editorTypes: string[] = []
+
+ try {
+ const promptFiles = fs.readdirSync(promptDir)
+ for (const file of promptFiles) {
+ if (file.endsWith('.md')) {
+ const editorName = path.basename(file, '.md')
+ editorTypes.push(editorName)
+ }
+ }
+ } catch {
+ console.warn('Could not read prompts directory, using empty editor types')
+ }
+
+ return editorTypes
+}
+
+/**
+ * Get formatted description of available refinement types
+ */
+export function getRefinementDescriptions(editorTypes: string[]): string {
+ return editorTypes.join(', ')
+}
+
+/**
+ * Enrich context for intro prompt on index.md files
+ */
+export function enrichIndexContext(filePath: string, content: string): string {
+ if (!filePath.endsWith('index.md')) return content
+
+ try {
+ const { data } = readFrontmatter(content)
+ if (!data) return content
+
+ // Extract product name from file path (e.g., content/github-models/ -> "GitHub Models")
+ const productMatch = filePath.replace(/\\/g, '/').match(/content\/([^/]+)/)
+ const productName = productMatch
+ ? productMatch[1]
+ .split('-')
+ .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+ .join(' ')
+ : ''
+
+ // Get child article titles
+ const titles: string[] = []
+ if (data.children && Array.isArray(data.children)) {
+ const dir = path.dirname(filePath)
+ for (const childPath of data.children.slice(0, 20)) {
+ try {
+ const childFile = path.join(dir, `${childPath.replace(/^\//, '')}.md`)
+ const childContent = fs.readFileSync(childFile, 'utf8')
+ const { data: childData } = readFrontmatter(childContent)
+ if (childData?.title) titles.push(childData.title)
+ } catch (error) {
+ if (process.env.AI_TOOLS_VERBOSE === 'true') {
+ console.warn('Failed to read or parse child article for intro context:', {
+ filePath,
+ childPath,
+ error,
+ })
+ }
+ }
+ }
+ }
+
+ // Build context note
+ const parts: string[] = []
+ if (productName) parts.push(`Product: ${productName}`)
+ if (titles.length > 0) parts.push(`Child articles: ${titles.join(', ')}`)
+
+ if (parts.length > 0) {
+ return `\n\n---\nContext for intro generation:\n${parts.join('\n')}\n---\n\n${content}`
+ }
+ } catch (error) {
+ if (process.env.AI_TOOLS_VERBOSE === 'true') {
+ console.warn('Failed to enrich index context for intro generation:', {
+ filePath,
+ error,
+ })
+ }
+ }
+
+ return content
+}
+
+/**
+ * Call an editor with the given content and options
+ */
+export async function callEditor(
+ editorType: string,
+ content: string,
+ promptDir: string,
+ writeMode: boolean,
+ verbose = false,
+ promptContent?: string, // Optional: use this instead of reading from file
+): Promise {
+ let markdownPrompt: string
+
+ if (promptContent) {
+ // Use provided prompt content (e.g., from Copilot Space)
+ markdownPrompt = promptContent
+ } else {
+ // Read from file
+ const markdownPromptPath = path.join(promptDir, `${editorType}.md`)
+
+ if (!fs.existsSync(markdownPromptPath)) {
+ throw new Error(`Prompt file not found: ${markdownPromptPath}`)
+ }
+
+ markdownPrompt = fs.readFileSync(markdownPromptPath, 'utf8')
+ }
+ const promptTemplatePath = path.join(promptDir, 'prompt-template.yml')
+
+ const prompt = yaml.load(fs.readFileSync(promptTemplatePath, 'utf8')) as PromptData
+
+ // Validate the prompt template has required properties
+ if (!prompt.messages || !Array.isArray(prompt.messages)) {
+ throw new Error('Invalid prompt template: missing or invalid messages array')
+ }
+
+ for (const msg of prompt.messages) {
+ msg.content = msg.content.replace('{{markdownPrompt}}', markdownPrompt)
+ msg.content = msg.content.replace('{{input}}', content)
+ // Replace writeMode template variable with simple string replacement
+ msg.content = msg.content.replace(
+ //g,
+ writeMode ? '' : '',
+ )
+ msg.content = msg.content.replace(
+ //g,
+ writeMode ? '' : '',
+ )
+ msg.content = msg.content.replace(
+ //g,
+ writeMode ? '' : '',
+ )
+
+ // Remove sections marked for removal
+ msg.content = msg.content.replace(/[\s\S]*?/g, '')
+ }
+
+ return callModelsApi(prompt, verbose)
+}
diff --git a/src/ai-tools/lib/spaces-utils.ts b/src/ai-tools/lib/spaces-utils.ts
new file mode 100644
index 000000000000..86c28f0477d1
--- /dev/null
+++ b/src/ai-tools/lib/spaces-utils.ts
@@ -0,0 +1,109 @@
+/**
+ * Copilot Space API response types
+ */
+export interface SpaceResource {
+ id: number
+ resource_type: string
+ copilot_chat_attachment_id: string | null
+ metadata: {
+ name: string
+ text: string
+ }
+}
+
+export interface SpaceData {
+ id: number
+ number: number
+ name: string
+ description: string
+ general_instructions: string
+ resources_attributes: SpaceResource[]
+ html_url: string
+ created_at: string
+ updated_at: string
+}
+
+/**
+ * Parse a Copilot Space URL to extract org and space ID
+ */
+export function parseSpaceUrl(url: string): { org: string; id: string } {
+ // Expected format: https://api.github.com/orgs/{org}/copilot-spaces/{id}
+ const match = url.match(/\/orgs\/([^/]+)\/copilot-spaces\/(\d+)/)
+
+ if (!match) {
+ throw new Error(
+ `Invalid Copilot Space URL format. Expected: https://api.github.com/orgs/{org}/copilot-spaces/{id}`,
+ )
+ }
+
+ return {
+ org: match[1],
+ id: match[2],
+ }
+}
+
+/**
+ * Fetch a Copilot Space from the GitHub API
+ */
+export async function fetchCopilotSpace(spaceUrl: string): Promise {
+ const { org, id } = parseSpaceUrl(spaceUrl)
+ const apiUrl = `https://api.github.com/orgs/${org}/copilot-spaces/${id}`
+
+ const response = await fetch(apiUrl, {
+ headers: {
+ Authorization: `Bearer ${process.env.GITHUB_TOKEN}`,
+ Accept: 'application/vnd.github+json',
+ 'X-GitHub-Api-Version': '2022-11-28',
+ },
+ })
+
+ if (!response.ok) {
+ if (response.status === 404) {
+ throw new Error(`Copilot Space not found: ${apiUrl}`)
+ } else if (response.status === 401 || response.status === 403) {
+ throw new Error(
+ `Authentication failed. Check your GitHub token has access to Copilot Spaces.`,
+ )
+ } else {
+ throw new Error(`Failed to fetch Copilot Space: ${response.status} ${response.statusText}`)
+ }
+ }
+
+ return (await response.json()) as SpaceData
+}
+
+/**
+ * Convert a Copilot Space to a markdown prompt file
+ */
+export function convertSpaceToPrompt(space: SpaceData): string {
+ const timestamp = new Date().toISOString()
+ const lines: string[] = []
+
+ // Header with metadata
+ lines.push(``)
+ lines.push(``)
+ lines.push(``)
+ lines.push('')
+
+ // General instructions
+ if (space.general_instructions) {
+ lines.push(space.general_instructions.trim())
+ lines.push('')
+ }
+
+ // Add each resource as a context section
+ if (space.resources_attributes && space.resources_attributes.length > 0) {
+ for (const resource of space.resources_attributes) {
+ if (resource.resource_type === 'free_text' && resource.metadata) {
+ lines.push('---')
+ lines.push('')
+ lines.push(`# Context: ${resource.metadata.name}`)
+ lines.push('')
+ lines.push(resource.metadata.text.trim())
+ lines.push('')
+ }
+ }
+ }
+
+ return lines.join('\n')
+}
diff --git a/src/ai-tools/prompts/content-type.md b/src/ai-tools/prompts/content-type.md
new file mode 100644
index 000000000000..d784cb6a5d66
--- /dev/null
+++ b/src/ai-tools/prompts/content-type.md
@@ -0,0 +1,38 @@
+Your job is to read through GitHub Docs articles that I provide and figure out what content type it _most_ aligns to and add the frontmatter property `contentType` with an appropriate value.
+
+**Available `contentType` values (MUST choose from this exact list):**
+
+- 'get-started' (MANDATORY for files with "quickstart" in the filename; also use for other getting started content)
+- 'concepts' (use for files with "about" in the filename; also use for other conceptual content)
+- 'how-tos' (use for procedural content AND for subdirectory index.md files that have a `children` array)
+- 'rai' (optional - only applies to files with "responsible-use" or "rai" in the filenames)
+- 'reference'
+- 'tutorials'
+
+There is one additional type, 'landing', which can ONLY be used on top-level product index.md files: 'content//index.md'
+
+**CRITICAL RULE**: If a file is an index.md with MORE than three directory parts (e.g., 'content///index.md'), it is a subdirectory index and should use 'how-tos', NOT 'landing'. The fact that it has a `children` array does NOT make it a landing page.
+
+For prior art, see the following file sets:
+
+- content/copilot/
+- content/actions/
+- content/account-and-profile/
+- content/integrations/
+
+## Output format
+
+**Important:** Output ONLY the new frontmatter property that should be added to the file. Do not output the entire file content.
+
+```yaml
+contentType: [selected option]
+```
+
+
+**CRITICAL**: You are in write mode. Output ONLY the YAML frontmatter properties to update.
+- Return just the YAML property in the format above
+- Do NOT include analysis, explanations, or formatting
+- Do NOT wrap in markdown code blocks or ```yaml
+- Do NOT include the analysis format
+- Just return the clean YAML properties for merging
+
\ No newline at end of file
diff --git a/src/ai-tools/prompts/intro.md b/src/ai-tools/prompts/intro.md
index ddf4eeccbbb2..b6aec3c14da7 100644
--- a/src/ai-tools/prompts/intro.md
+++ b/src/ai-tools/prompts/intro.md
@@ -1,38 +1,39 @@
-You are an expert SEO content optimizer specializing in GitHub documentation.
-Your task is to analyze a GitHub Docs content file and generate or optimize
+You are an expert SEO content optimizer specializing in GitHub documentation.
+Your task is to analyze a GitHub Docs content file and generate or optimize
the intro frontmatter property following Google's meta description best practices.
-## Your mission
-
-Generate a single, concise intro (one simple sentence maximum - NO colons, NO detailed explanations) that:
+## Context for index.md files
-* Starts with an action verb (e.g., "Learn," "Discover," "Access," "Explore," "Configure," "Set up," "Build")
-* **Uses developer-friendly, direct language** - avoid marketing jargon and corporate buzzwords
-* **Prioritizes conciseness over completeness** - cut unnecessary words ruthlessly
-* Accurately summarizes the content's core value proposition
-* Includes relevant keywords naturally without stuffing
-* Follows Google's snippet guidelines (descriptive, informative, compelling)
-* Is version-agnostic (no {% ifversion %} blocks, but {% data variables.* %} and {% data reusables.* %} are acceptable)
-* Matches the content type (article/category/mapTopic) requirements
-* **Goes beyond title restatement** - summarizes the complete article value, not just rephrasing the title
-* **Lists concrete steps or outcomes** - what users will actually do or accomplish
-* **Limits lists to 2-3 items maximum** - avoid long comma-separated sequences that feel overwhelming
+For index.md files, you will receive additional context about the product and child articles:
+- Product name (e.g., "GitHub Models", "GitHub Copilot")
+- List of child article titles
-## SEO scoring criteria (1-10 scale)
+Use this context to create specific, product-focused intros rather than generic guidance.
-**10-9 (Excellent)**: Strong action verb, comprehensive content summary, optimal keyword density, clear unique value beyond title, perfect length
-**8-7 (Good)**: Action verb present, good content representation, decent keywords, some unique value, appropriate length
-**6-5 (Fair)**: Weak action verb or missing, partial content coverage, basic keywords, minimal value beyond title
-**4-3 (Poor)**: No action verb, limited content representation, few relevant keywords, mostly restates title
-**2-1 (Very Poor)**: Vague or misleading, no clear value proposition, poor keyword usage, completely redundant with title
+**Examples of good vs generic intros:**
+- ā "Explore tutorials to build projects and learn new skills with GitHub"
+- ā "Learn practical guides and step-by-step instructions"
+- ā
"Build AI applications with GitHub Models through hands-on tutorials covering model evaluation and deployment"
-## Analysis process
+## Core Requirements
-1. **Content resolution**: Keep {% data variables.* %} and {% data reusables.* %} but avoid {% ifversion %} blocks
-2. **Content analysis**: Identify the article's purpose, target audience, key concepts, and user outcomes
-3. **Category detection**: For index pages, analyze child content themes and collective value
+**Primary constraints (must-haves):**
+* Start with action verb ("Learn," "Access," "Explore," "Configure," "Set up," "Build")
+* One sentence maximum - NO colons, NO detailed explanations
+* Avoid buzzwords: "leverage," "optimize," "maximize," "enhance," "streamline," "empower," "revolutionize," "seamlessly," "comprehensive," "enterprise-grade," "cutting-edge," "innovative," "game-changing," "next-generation," "world-class," "best-in-class," "state-of-the-art," "industry-leading," "robust," "scalable," "mission-critical," "synergistic," "holistic," "strategic," "transformative"
+* Different approach than title - don't start with same words/phrases
+* Lists 2-3 concrete outcomes maximum
-4. **SEO optimization**: Use strong action verbs, developer-friendly language, concrete outcomes, and relevant keywords while avoiding corporate buzzwords
+**For index.md files:**
+* Use the provided product name and child article context to create specific intros
+* Identify key themes from child article titles to highlight covered topics
+* Make intro specific to the product and topics, not generic guidance
+
+**Secondary optimizations (nice-to-haves):**
+* Include relevant keywords naturally
+* Version-agnostic ({% data variables.* %} OK, avoid {% ifversion %})
+* Follow Google snippet guidelines
+* Cut unnecessary words ruthlessly
**Content Summarization vs. Title Restatement**:
@@ -47,7 +48,7 @@ Generate a single, concise intro (one simple sentence maximum - NO colons, NO de
- Better: "Use {% data variables.product.prodname_copilot %} chat and code completion to research syntax, practice coding, and master new programming languages faster"
ā
**Use concise, developer-friendly language ({% data variables.* %} OK)**:
-- Better intro: "Evaluate use cases, configure security settings, and run pilot trials to successfully deploy {% data variables.copilot.copilot_coding_agent %} in your org"
+- Better intro: "Evaluate use cases, configure security settings, and run pilot trials to deploy {% data variables.copilot.copilot_coding_agent %} in your org"
ā **Avoid overly long lists and colon constructions**:
- Too long: "Scope issues, pick suitable tasks, iterate via PR comments, add repo instructions, enable MCP tools, and preinstall dependencies"
@@ -55,24 +56,22 @@ Generate a single, concise intro (one simple sentence maximum - NO colons, NO de
- Better: "Scope tasks, configure custom instructions, and iterate on pull requests to improve {% data variables.copilot.copilot_coding_agent %} performance"
- Better: "Use {% data variables.product.prodname_copilot %} features like chat and code completion to research syntax, build programs, and learn new programming languages faster"
-**Tone Guidelines**:
-- **Developer-friendly**: Use direct, practical language
-- **Concise over complete**: Cut words ruthlessly
-- **Action-oriented**: List what users will actually do
-- **Avoid buzzwords**: Skip marketing language and corporate jargon
-- **Use concrete verbs**: Instead of "maximize/optimize/enhance" ā use "improve," "boost," "increase," or just describe the outcome directly
-- **Limit lists**: Maximum 2-3 items in comma-separated lists - prefer flowing sentences over exhaustive enumerations
-- **Avoid colon constructions**: Don't use "Do X: detailed explanation of A, B, and C" format - keep it simple and direct
-- **Avoid title similarity**: Don't start with the same words/phrases as the article title - approach the topic from a different angle
+## Quality Checklist
+
+ā
**Structure**: Action verb + 2-3 concrete outcomes + under 350 characters
+ā
**Language**: Direct, practical developer language (no marketing jargon)
+ā
**Focus**: What users will DO, not what solution "provides"
+ā
**Uniqueness**: Different angle from article title
+ā
**Simplicity**: No colons, no complex lists, flowing sentences
-The intro should answer: "What specific steps will I take?" rather than "What will this comprehensive solution provide?"
+**Examples for index.md files:**
-## Analysis Process
+ā **Too generic** (ignores provided context):
+- Bad: "Explore practical guides and step-by-step instructions to accomplish tasks and solve problems on GitHub"
-1. **First Draft**: Generate an initial improved intro following all guidelines above
-2. **Title Check**: Compare your draft to the article title - if it starts with similar words, rewrite with a different approach
-3. **Self-Review**: Evaluate your draft against the SEO scoring criteria and tone guidelines
-4. **Refinement**: If the draft contains buzzwords, weak verbs, title similarity, or scores below 8/10, create a refined version
+ā
**Product-specific** (uses provided context):
+- Better: "Learn to use GitHub Models for prototyping, evaluate AI models, and scale deployments across your organization"
+- Or: "Build AI-powered applications with GitHub Models, from initial testing to enterprise-scale deployment"
## Output format
@@ -84,44 +83,49 @@ Title: "[Article title from frontmatter]"
Original intro: "[Current intro from the article, or "No intro" if none exists]"
-
-Original SEO score: [X]/10
-------------------------
-
-Improved intro: "[Single, concise intro that summarizes the article's full content value, not just restating the title]"
-
-
-Improved SEO score: [X]/10
+SEO-friendly alternative: "[Single, concise intro that summarizes the article's full content value, not just restating the title]"
------------------------
```
-Note: The improved score should reflect your best attempt after internal refinement.
-
## Character limits by content type
-**Priority: Conciseness over character limits**
-- Focus on being as concise as possible while maintaining clarity
-- Cut every unnecessary word before considering length
-- Developer-friendly brevity trumps hitting character targets
-
-**Technical limits** (for reference):
- **Articles**: Maximum 354 characters
-- **Categories**: Maximum 362 characters
+- **Categories**: Maximum 362 characters
- **Map Topics**: Maximum 362 characters
## Liquid syntax guidelines
-**Keep these in intros** (they're acceptable for dynamic content):
-- {% data variables.* %} - Product names and variables
-- {% data reusables.* %} - Reusable content blocks
+**When creating intros from scratch** (no existing intro field):
+- Use plain text only - DO NOT use {% data variables.* %} or {% data reusables.* %} syntax
+- Write out product names in full (e.g., "GitHub Copilot", "GitHub Actions", "GitHub Docs")
+- This prevents hallucinating incorrect variable names
+
+**When updating existing intros** (intro field already exists):
+- Preserve any existing {% data variables.* %} and {% data reusables.* %} references
+- You may use the same variable patterns that already appear in the existing intro
+- Do not introduce new variable references that weren't in the original
-**Avoid these in intros** (version-agnostic content preferred):
+**Always avoid**:
- {% ifversion %} blocks - Create intros that work across all supported versions
-**Common variable meanings** (for analysis purposes):
-- {% data variables.product.prodname_github %} = "GitHub"
-- {% data variables.product.prodname_ghe_server %} = "GitHub Enterprise Server"
-- {% data variables.product.prodname_copilot %} = "GitHub Copilot"
-- {% data variables.copilot.copilot_coding_agent %} = "Copilot Coding Agent"
+Focus on creating intros that would make sense to someone discovering this content through Google search, clearly communicating the value and relevance of the article.
+
+
+
+## WRITE MODE INSTRUCTIONS
+
+**CRITICAL**: You are in write mode. Output ONLY the YAML frontmatter property to update.
+
+**For index.md files:**
+- Use the provided product name and child article context in your intro
+- Do NOT write generic intros that could apply to any product
+- Make the intro specific to the actual product and covered topics
+
+**Output format:**
+- Return just: `intro: "your improved intro text"`
+- Do NOT include analysis, scoring, explanations, or formatting
+- Do NOT wrap in markdown code blocks or ```yaml
+- Do NOT include the analysis format shown above
+- Just return the clean YAML property line
-Focus on creating intros that would make sense to someone discovering this content through Google search, clearly communicating the value and relevance of the article.
\ No newline at end of file
+
\ No newline at end of file
diff --git a/src/ai-tools/prompts/prompt-template.yml b/src/ai-tools/prompts/prompt-template.yml
index dab8d13adfa9..293a3decfe8e 100644
--- a/src/ai-tools/prompts/prompt-template.yml
+++ b/src/ai-tools/prompts/prompt-template.yml
@@ -6,4 +6,6 @@ messages:
content: >-
Review this content file according to the provided system prompt.
{{input}}
-model: openai/gpt-5
+model: openai/gpt-4o # Reliable model that works
+temperature: 0.3 # Lower temperature for consistent results
+max_completion_tokens: 4000 # Maximum response length
diff --git a/src/ai-tools/scripts/ai-tools.ts b/src/ai-tools/scripts/ai-tools.ts
index 1be467e02b0b..62f2d3a04cfb 100644
--- a/src/ai-tools/scripts/ai-tools.ts
+++ b/src/ai-tools/scripts/ai-tools.ts
@@ -1,64 +1,38 @@
-import { fileURLToPath } from 'url'
import { Command } from 'commander'
import fs from 'fs'
-import yaml from 'js-yaml'
import path from 'path'
import ora from 'ora'
-import { execSync } from 'child_process'
-import { callModelsApi } from '@/ai-tools/lib/call-models-api'
+import { execFileSync } from 'child_process'
import dotenv from 'dotenv'
+import readFrontmatter from '@/frame/lib/read-frontmatter'
+import { findMarkdownFiles, mergeFrontmatterProperties } from '@/ai-tools/lib/file-utils'
+import {
+ getPromptsDir,
+ getAvailableEditorTypes,
+ getRefinementDescriptions,
+ callEditor,
+ enrichIndexContext,
+} from '@/ai-tools/lib/prompt-utils'
+import { fetchCopilotSpace, convertSpaceToPrompt } from '@/ai-tools/lib/spaces-utils'
+import { ensureGitHubToken } from '@/ai-tools/lib/auth-utils'
dotenv.config({ quiet: true })
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const promptDir = path.join(__dirname, '../prompts')
-const promptTemplatePath = path.join(promptDir, 'prompt-template.yml')
-
-if (!process.env.GITHUB_TOKEN) {
- // Try to find a token via the CLI before throwing an error
- const token = execSync('gh auth token').toString()
- if (token.startsWith('gh')) {
- process.env.GITHUB_TOKEN = token
- } else {
- console.warn(`š A token is needed to run this script. Please do one of the following and try again:
-
-1. Add a GITHUB_TOKEN to a local .env file.
-2. Install https://cli.github.com and authenticate via 'gh auth login'.
- `)
- process.exit(1)
- }
-}
+const promptDir = getPromptsDir()
-interface EditorType {
- description: string
-}
-
-interface EditorTypes {
- versioning: EditorType
- intro: EditorType
-}
+// Ensure GitHub token is available
+ensureGitHubToken()
-const editorTypes: EditorTypes = {
- versioning: {
- description: 'Refine versioning according to simplification guidance.',
- },
- intro: {
- description: 'Refine intro frontmatter based on SEO and content guidelines.',
- },
-}
-
-const refinementDescriptions = (): string => {
- let str = '\n\n'
- for (const [ed, edObj] of Object.entries(editorTypes)) {
- str += ` ${ed.padEnd(12)} ${edObj.description}\n`
- }
- return str
-}
+const editorTypes = getAvailableEditorTypes(promptDir)
interface CliOptions {
verbose?: boolean
- refine: Array
- files: string[]
+ prompt?: string[]
+ refine?: string[]
+ files?: string[]
write?: boolean
+ exportSpace?: string
+ space?: string
+ output?: string
}
const program = new Command()
@@ -71,20 +45,118 @@ program
'-w, --write',
'Write changes back to the original files (default: output to console only)',
)
- .requiredOption(
+ .option(
+ '-p, --prompt ',
+ `Specify one or more prompt type: ${getRefinementDescriptions(editorTypes)}`,
+ )
+ .option(
'-r, --refine ',
- `Specify one or more refinement type: ${refinementDescriptions().trimEnd()}\n`,
+ `(Deprecated: use --prompt) Specify one or more prompt type: ${getRefinementDescriptions(editorTypes)}`,
)
- .requiredOption(
- '-f, --files ',
- 'One or more content file paths in the content directory',
+ .option(
+ '--export-space ',
+ 'Export a Copilot Space to a prompt file (format: https://api.github.com/orgs/{org}/copilot-spaces/{id})',
)
+ .option(
+ '--space ',
+ 'Use a Copilot Space as prompt source (format: https://api.github.com/orgs/{org}/copilot-spaces/{id})',
+ )
+ .option(
+ '--output ',
+ 'Output filename for exported Space prompt (use with --export-space)',
+ )
+ .option('-f, --files ', 'One or more content file paths in the content directory')
.action((options: CliOptions) => {
;(async () => {
+ // Handle export-space workflow (standalone, doesn't process files)
+ if (options.exportSpace) {
+ if (!options.output) {
+ console.error('Error: --export-space requires --output option')
+ process.exit(1)
+ }
+
+ const spinner = ora('Fetching Copilot Space...').start()
+ try {
+ const space = await fetchCopilotSpace(options.exportSpace)
+ spinner.text = `Converting Space "${space.name}" to prompt format...`
+
+ const promptContent = convertSpaceToPrompt(space)
+ const outputPath = path.join(promptDir, options.output)
+
+ fs.writeFileSync(outputPath, promptContent, 'utf8')
+ spinner.succeed(`Exported Space to: ${outputPath}`)
+ console.log(`\nSpace: ${space.name}`)
+ console.log(`Resources: ${space.resources_attributes?.length || 0} items`)
+ console.log(`\nYou can now use it with: --prompt ${path.basename(options.output, '.md')}`)
+ return
+ } catch (error) {
+ spinner.fail(`Failed to export Space: ${(error as Error).message}`)
+ process.exit(1)
+ }
+ }
+
+ // Validate mutually exclusive options
+ if (options.space && options.prompt) {
+ console.error('Error: Cannot use both --space and --prompt options')
+ process.exit(1)
+ }
+
+ // Files are required for processing workflows
+ if (!options.files || options.files.length === 0) {
+ console.error('Error: --files option is required (unless using --export-space)')
+ process.exit(1)
+ }
+
const spinner = ora('Starting AI review...').start()
const files = options.files
- const editors = options.refine
+ let prompts: string[] = []
+ let promptContent: string | undefined
+
+ // Handle Space workflow (in-memory)
+ if (options.space) {
+ try {
+ spinner.text = 'Fetching Copilot Space...'
+ const space = await fetchCopilotSpace(options.space)
+ promptContent = convertSpaceToPrompt(space)
+ prompts = [space.name] // Use space name for display
+
+ if (options.verbose) {
+ console.log(`Using Space: ${space.name} (ID: ${space.number})`)
+ console.log(`Resources: ${space.resources_attributes?.length || 0} items`)
+ }
+ } catch (error) {
+ spinner.fail(`Failed to fetch Space: ${(error as Error).message}`)
+ process.exit(1)
+ }
+ } else {
+ // Handle local prompt workflow
+ prompts = options.prompt || options.refine || []
+
+ if (prompts.length === 0) {
+ spinner.fail('No prompt type specified. Use --prompt, --refine, or --space.')
+ process.exitCode = 1
+ return
+ }
+ }
+
+ // Validate local prompt types exist (skip for Space workflow)
+ if (!options.space) {
+ const availableEditors = editorTypes
+ for (const editor of prompts) {
+ if (!availableEditors.includes(editor)) {
+ spinner.fail(
+ `Unknown prompt type: ${editor}. Available types: ${availableEditors.join(', ')}`,
+ )
+ process.exitCode = 1
+ return
+ }
+ }
+ }
+
+ if (options.verbose) {
+ console.log(`Processing ${files.length} files with prompts: ${prompts.join(', ')}`)
+ }
for (const file of files) {
const filePath = path.resolve(process.cwd(), file)
@@ -96,69 +168,175 @@ program
continue
}
- try {
- spinner.text = `Reading file: ${file}`
- const content = fs.readFileSync(filePath, 'utf8')
-
- for (const editorType of editors) {
- spinner.text = `Running the AI-powered ${editorType} refinement...`
- const answer = await callEditor(editorType, content, options.write || false)
- spinner.stop()
-
- if (options.write) {
- // Write the result back to the original file
- fs.writeFileSync(filePath, answer, 'utf8')
- console.log(`ā
Updated: ${file}`)
+ // Check if it's a directory
+ const isDirectory = fs.statSync(filePath).isDirectory()
+
+ for (const editorType of prompts) {
+ try {
+ // For other editor types, process individual files
+ const filesToProcess: string[] = []
+
+ if (isDirectory) {
+ // Find all markdown files in the directory recursively
+ // Use process.cwd() as the root directory for safety
+ const rootDir = fs.realpathSync(process.cwd())
+ filesToProcess.push(...findMarkdownFiles(filePath, rootDir))
+
+ if (filesToProcess.length === 0) {
+ spinner.warn(`No markdown files found in directory: ${file}`)
+ continue
+ }
+
+ spinner.text = `Found ${filesToProcess.length} markdown files in ${file}`
} else {
- // Just output to console (current behavior)
- console.log(answer)
+ filesToProcess.push(filePath)
}
+
+ spinner.start()
+ for (const fileToProcess of filesToProcess) {
+ const relativePath = path.relative(process.cwd(), fileToProcess)
+ spinner.text = `Processing: ${relativePath}`
+ try {
+ // Expand Liquid references before processing
+ let originalIntro = ''
+ if (editorType === 'intro') {
+ const originalContent = fs.readFileSync(fileToProcess, 'utf8')
+ const { data: originalData } = readFrontmatter(originalContent)
+ originalIntro = originalData?.intro || ''
+ }
+
+ if (options.verbose) {
+ console.log(`Expanding Liquid references in: ${relativePath}`)
+ }
+ runLiquidTagsScript('expand', [fileToProcess], options.verbose || false)
+
+ let content = fs.readFileSync(fileToProcess, 'utf8')
+
+ // For intro prompt, add original intro and enrich context
+ if (editorType === 'intro') {
+ if (originalIntro) {
+ content = `\n\n---\nOriginal intro (unresolved): ${originalIntro}\n---\n\n${content}`
+ }
+ content = enrichIndexContext(fileToProcess, content)
+ }
+
+ // For content-type prompt, skip files that already have contentType
+ if (editorType === 'content-type' && content.includes('contentType:')) {
+ spinner.stop()
+ console.log(`āļø Skipping ${relativePath} (already has contentType)`)
+ runLiquidTagsScript('restore', [fileToProcess], false)
+ continue
+ }
+
+ const answer = await callEditor(
+ editorType,
+ content,
+ promptDir,
+ options.write || false,
+ options.verbose || false,
+ promptContent, // Pass Space prompt content if using --space
+ )
+ spinner.stop()
+
+ if (options.write) {
+ if (editorType === 'intro' || editorType === 'content-type') {
+ // For frontmatter addition/modification, merge properties instead of overwriting entire file
+ const updatedContent = mergeFrontmatterProperties(fileToProcess, answer)
+ fs.writeFileSync(fileToProcess, updatedContent, 'utf8')
+ console.log(`ā
Added frontmatter properties to: ${relativePath}`)
+ } else {
+ // For other editor types, write the full result back to the original file
+ fs.writeFileSync(fileToProcess, answer, 'utf8')
+ console.log(`ā
Updated: ${relativePath}`)
+ }
+ } else {
+ // Just output to console (current behavior)
+ if (filesToProcess.length > 1) {
+ console.log(`\n=== ${relativePath} ===`)
+ }
+ console.log(answer)
+ }
+
+ // Always restore Liquid references after processing (even in non-write mode)
+ if (options.verbose) {
+ console.log(`Restoring Liquid references in: ${relativePath}`)
+ }
+ runLiquidTagsScript('restore', [fileToProcess], options.verbose || false)
+ } catch (err) {
+ const error = err as Error
+ spinner.fail(`Error processing ${relativePath}: ${error.message}`)
+ process.exitCode = 1
+
+ // Still try to restore Liquid references on error
+ try {
+ runLiquidTagsScript('restore', [fileToProcess], false)
+ } catch (restoreError) {
+ // Log restore failures in verbose mode for debugging
+ if (options.verbose) {
+ console.error(`Warning: Failed to restore Liquid references: ${restoreError}`)
+ }
+ }
+ } finally {
+ spinner.stop()
+ }
+ }
+ } catch (err) {
+ const error = err as Error
+ const targetName = path.relative(process.cwd(), filePath)
+ spinner.fail(`Error processing ${targetName}: ${error.message}`)
+ process.exitCode = 1
}
- } catch (err) {
- const error = err as Error
- spinner.fail(`Error processing file ${file}: ${error.message}`)
- process.exitCode = 1
}
}
spinner.stop()
+
+ // Exit with appropriate code based on whether any errors occurred
+ if (process.exitCode) {
+ process.exit(process.exitCode)
+ }
})()
})
program.parse(process.argv)
-interface PromptMessage {
- content: string
- role: string
-}
-
-interface PromptData {
- messages: PromptMessage[]
- model?: string
- temperature?: number
- max_tokens?: number
-}
-
-async function callEditor(
- editorType: keyof EditorTypes,
- content: string,
- writeMode: boolean,
-): Promise {
- const markdownPromptPath = path.join(promptDir, `${editorType}.md`)
- let markdownPrompt = fs.readFileSync(markdownPromptPath, 'utf8')
-
- // For intro type in write mode, append special instructions
- if (editorType === 'intro' && writeMode) {
- markdownPrompt +=
- '\n\n**WRITE MODE**: Output only the complete updated file content with the new intro in the frontmatter. Do not include analysis or explanations - just return the file ready to write.'
+/**
+ * Run liquid-tags command on specified file paths
+ */
+function runLiquidTagsScript(
+ command: 'expand' | 'restore',
+ filePaths: string[],
+ verbose: boolean = false,
+): void {
+ const args = [command, '--paths', ...filePaths]
+ if (verbose) {
+ args.push('--verbose')
}
- const prompt = yaml.load(fs.readFileSync(promptTemplatePath, 'utf8')) as PromptData
-
- for (const msg of prompt.messages) {
- msg.content = msg.content.replace('{{markdownPrompt}}', markdownPrompt)
- msg.content = msg.content.replace('{{input}}', content)
+ try {
+ // Run liquid-tags script via tsx
+ const liquidTagsScriptPath = path.join(
+ process.cwd(),
+ 'src/content-render/scripts/liquid-tags.ts',
+ )
+ execFileSync('npx', ['tsx', liquidTagsScriptPath, ...args], {
+ stdio: verbose ? 'inherit' : 'pipe',
+ })
+ } catch (error) {
+ if (verbose) {
+ console.error(`Error running liquid-tags ${command}:`, error)
+ }
+ // Don't fail the entire process if liquid-tags fails
}
-
- return callModelsApi(prompt)
}
+
+// Handle graceful shutdown
+process.on('SIGINT', () => {
+ console.log('\n\nš Process interrupted by user')
+ process.exit(0)
+})
+
+process.on('SIGTERM', () => {
+ console.log('\n\nš Process terminated')
+ process.exit(0)
+})
diff --git a/src/app/README.md b/src/app/README.md
new file mode 100644
index 000000000000..02da61ada4ef
--- /dev/null
+++ b/src/app/README.md
@@ -0,0 +1,71 @@
+# App Router (`src/app`)
+
+This directory contains the [Next.js App Router](https://nextjs.org/docs/app) implementation for GitHub Docs. It currently serves as the application shell, handling the root layout, global providers, and 404 error pages, while coexisting with the Pages Router implementation.
+
+## Purpose & Scope
+
+The `src/app` directory is the entry point for the Next.js App Router. Its primary responsibilities are:
+- Defining the root HTML structure and metadata.
+- Initializing global client-side context providers (Theme, Locale, Languages).
+- Handling global "Not Found" (404) scenarios.
+- Providing a bridge between the modern App Router architecture and the `MainContext` used by existing components.
+
+We began this migration because we anticipate `@primer/react` will eventually drop support for the Pages Router. If that happens, we will be unable to upgrade `@primer/react`, effectively blocking us from receiving any future design system updates. Moving to the App Router prevents this and aligns us with the broader Next.js ecosystem.
+
+## Architecture & Key Assets
+
+### Directory Structure
+
+- `layout.tsx`: The server-side Root Layout. It sets up the `` and `` tags, loads global styles, and defines metadata/viewport settings.
+- `client-layout.tsx`: A client component (`'use client'`) that wraps the application in necessary React Context providers. This allows server components to compose client-side logic for theming and state management.
+- `not-found.tsx`: The UI for 404 errors within the App Router.
+- `lib/`: Utilities for context adaptation and routing logic.
+ - `app-router-context.ts`: Generates context data based on the current request path.
+ - `main-context-adapter.ts`: Adapts App Router data structures to match the `MainContext` shape, ensuring backward compatibility for components.
+- `components/`: Client-side components specific to the App Router shell (e.g., wrappers for 404 pages, context providers).
+
+### Key Concepts
+
+- **Context Adaptation**: Since much of the codebase relies on a monolithic `MainContext`, this directory implements adapters to construct a compatible context object from App Router primitives. This allows us to reuse existing components without rewriting them immediately.
+- **Hybrid Routing**: The application currently operates in a hybrid mode. While `src/app` defines the outer shell, many specific routes and page rendering logic may still reside in the Pages Router (`src/pages`) or are being incrementally migrated.
+
+## Setup & Usage
+
+### Development
+
+Standard Next.js App Router conventions apply. To add a new route using the App Router, create a folder with a `page.tsx` file inside `src/app`.
+
+Useful documentation:
+- [Next.js App Router Documentation](https://nextjs.org/docs/app)
+- [Migrating from Pages to App Router](https://nextjs.org/docs/app/building-your-application/upgrading/app-router-migration)
+
+### Testing
+
+Tests for App Router logic should be placed alongside the components if applicable.
+
+Tests that verify Next.js behavior (like 404 handling) can be found in `src/frame/tests/next.ts`.
+
+## Data & External Dependencies
+
+- **Data Sources**:
+ - Consumes UI strings and language data from `src/data-directory` (via `getUIDataMerged`).
+ - Uses `src/languages` for locale definitions.
+- **External Libraries**:
+ - `@primer/react`: Used for the design system and theming provider.
+ - `next`: The core framework.
+
+## Cross-links & Ownership
+
+- **Owner**: Docs Engineering
+- **Related Directories**:
+ - `src/pages`: The Pages Router implementation.
+ - `src/frame`: Server and middleware logic that interacts with routing.
+ - `src/data-directory`: Source of static data used in layouts.
+
+## Current State & Next Steps
+
+- **Current State**: The App Router handles the root layout and 404s. It provides a compatibility layer for existing contexts.
+- **Next Steps**:
+ - Migrate individual page routes from `src/pages` to `src/app`.
+ - Refactor components to reduce dependency on the monolithic `MainContext`.
+ - Improve data fetching patterns to use React Server Components (RSC) more effectively.
\ No newline at end of file
diff --git a/src/app/lib/app-router-context.ts b/src/app/lib/app-router-context.ts
index 3e0e8e75ecc2..455705576dec 100644
--- a/src/app/lib/app-router-context.ts
+++ b/src/app/lib/app-router-context.ts
@@ -2,6 +2,7 @@ import { getUIDataMerged } from '@/data-directory/lib/get-data'
import { type LanguageCode } from '@/languages/lib/languages'
import { translate } from '@/languages/lib/translation-utils'
import { extractLanguageFromPath } from '@/app/lib/language-utils'
+import { type UIStrings } from '@/frame/components/context/MainContext'
export interface AppRouterContext {
currentLanguage: LanguageCode
@@ -9,7 +10,7 @@ export interface AppRouterContext {
sitename: string
site: {
data: {
- ui: any
+ ui: UIStrings
}
}
}
diff --git a/src/app/lib/main-context-adapter.ts b/src/app/lib/main-context-adapter.ts
index ee79b2b62693..ccca0c98a17a 100644
--- a/src/app/lib/main-context-adapter.ts
+++ b/src/app/lib/main-context-adapter.ts
@@ -40,6 +40,7 @@ export function adaptAppRouterContextToMainContext(
oldestSupported: '',
nextDeprecationDate: '',
supported: [],
+ releasesWithOldestDeprecationDate: [],
},
enterpriseServerVersions: [],
error: '',
diff --git a/src/app/lib/server-context-utils.ts b/src/app/lib/server-context-utils.ts
index 7bb74149c22f..3d4dcec2df13 100644
--- a/src/app/lib/server-context-utils.ts
+++ b/src/app/lib/server-context-utils.ts
@@ -3,12 +3,13 @@ import { extractVersionFromPath } from '@/app/lib/version-utils'
import { getUIDataMerged } from '@/data-directory/lib/get-data'
import { type LanguageCode } from '@/languages/lib/languages'
import { createTranslationFunctions, translate } from '@/languages/lib/translation-utils'
+import type { UIStrings } from '@/frame/components/context/MainContext'
export interface ServerAppRouterContext {
currentLanguage: LanguageCode
currentVersion: string
sitename: string
- site: { data: { ui: any } }
+ site: { data: { ui: UIStrings } }
}
/**
diff --git a/src/archives/README.md b/src/archives/README.md
index 8aeee1670109..98f3f3148125 100644
--- a/src/archives/README.md
+++ b/src/archives/README.md
@@ -1,5 +1,86 @@
# Archives
-Product oriented code to handle archived versions of the Docs, such as archived Enterprise Server versions.
+This directory contains the infrastructure for serving archived versions of GitHub Docs, primarily for deprecated GitHub Enterprise Server (GHES) releases.
-The directory `versions/` handles non-archived versions of the docs. `ghes-releases/` handles version releases and deprecations processes.
+## Purpose & Scope
+
+To keep the main documentation site fast and the build lightweight, we do not build deprecated GHES versions from source. Instead, we serve them as static snapshots. This directory provides the middleware that:
+
+1. **Detects** requests for archived versions.
+2. **Proxies** the HTML and assets from their static hosting location.
+3. **Rewrites** content on-the-fly to ensure links and assets work correctly within the current site structure.
+
+## Architecture
+
+The system acts as a reverse proxy for specific URL paths.
+
+### Directory Structure
+
+- **`middleware/`**
+ - `archived-enterprise-versions.ts`: The primary handler. It:
+ - Checks if a URL belongs to a deprecated version.
+ - Fetches the content from the external host.
+ - Rewrites HTML (e.g., fixing image paths, injecting new headers).
+ - Handles redirects defined in the archived version's `redirects.json`.
+ - `archived-enterprise-versions-assets.ts`: Proxies static assets (CSS, JS, fonts) from the archive host.
+ - `archived-asset-redirects.ts`: Maps legacy asset paths to modern equivalents where possible.
+- **`lib/`**
+ - `is-archived-version.ts`: Utilities to parse URLs and check against the list of deprecated versions defined in `src/versions`.
+- **`scripts/`**
+ - `warmup-remotejson.ts`: Utility to prime caches for remote JSON files.
+
+### Request Flow
+
+```mermaid
+graph TD
+ A[Incoming Request] --> B{Is Archived Version?}
+ B -- No --> C[Next Middleware]
+ B -- Yes --> D{Is Asset?}
+ D -- Yes --> E[archived-enterprise-versions-assets]
+ D -- No --> F[archived-enterprise-versions]
+ E --> G[Fetch from docs-ghes-X.X repo]
+ F --> H[Fetch HTML from docs-ghes-X.X repo]
+ H --> I[Rewrite Body & Headers]
+ I --> J[Serve Response]
+ G --> J
+```
+
+## Data & External Dependencies
+
+### External Hosting
+Archived versions are hosted as static sites on GitHub Pages, typically in repositories named `github/docs-ghes-`.
+- **Source**: `https://github.github.com/docs-ghes-`
+- **Content**: These repos contain the fully built static HTML and assets for that version at the time of its deprecation.
+
+### Internal Dependencies
+- **`src/versions`**: The `deprecated` array in `src/versions/lib/enterprise-server-releases.ts` is the source of truth for which versions are handled by this middleware.
+- **`src/frame`**: Uses shared patterns and fetch utilities.
+
+## Setup & Usage
+
+This functionality is enabled by default in the application.
+
+### Local Development
+To test archived versions locally:
+1. Ensure you have internet access (the middleware fetches from public URLs).
+2. Navigate to a deprecated version URL, e.g., `http://localhost:4000/enterprise-server@3.0`.
+
+### Adding a New Archive
+When a GHES version is deprecated:
+1. A static snapshot is created and pushed to a `docs-ghes-` repository.
+2. The version is moved to the `deprecated` list in `src/versions/lib/enterprise-server-releases.ts`.
+3. This middleware automatically starts handling requests for that version.
+
+## Ownership & Cross-links
+
+- **Owner**: Docs Engineering
+- **Related Code**:
+ - `src/versions`: Version configuration.
+ - `src/ghes-releases`: Release lifecycle management.
+
+## Current State & Next Steps
+
+- **Health**: The system is stable (KTLO) but relies on the availability of the external GitHub Pages sites. A new version is deprecated and added to this system approximately once per quarter.
+- **Known Issues**:
+ - "Flash of content" or layout shifts can occur if CSS proxies are slow.
+ - Search is generally disabled or limited for archived versions.
diff --git a/src/archives/middleware/archived-enterprise-versions.ts b/src/archives/middleware/archived-enterprise-versions.ts
index 74dbf9caf2e1..cce873631096 100644
--- a/src/archives/middleware/archived-enterprise-versions.ts
+++ b/src/archives/middleware/archived-enterprise-versions.ts
@@ -2,6 +2,7 @@ import type { Response, NextFunction } from 'express'
import { fetchWithRetry } from '@/frame/lib/fetch-utils'
import statsd from '@/observability/lib/statsd'
+import { createLogger } from '@/observability/logger'
import {
firstVersionDeprecatedOnNewSite,
lastVersionWithoutArchivedRedirectsFile,
@@ -19,6 +20,8 @@ import getRedirect, { splitPathByLanguage } from '@/redirects/lib/get-redirect'
import getRemoteJSON from '@/frame/lib/get-remote-json'
import { ExtendedRequest } from '@/types'
+const logger = createLogger(import.meta.url)
+
const OLD_PUBLIC_AZURE_BLOB_URL = 'https://githubdocs.azureedge.net'
// Old Azure Blob Storage `enterprise` container.
const OLD_AZURE_BLOB_ENTERPRISE_DIR = `${OLD_PUBLIC_AZURE_BLOB_URL}/enterprise`
@@ -78,11 +81,17 @@ const cacheAggressively = (res: Response) => {
const retryConfiguration = { limit: 3 }
// According to our Datadog metrics, the *average* time for the
// the 'archive_enterprise_proxy' metric is ~70ms (excluding spikes)
-// which much less than 1500ms.
+// which is much less than 3000ms.
// We have observed errors of timeout, in production, when it was
-// set to 500ms. Let's try to be very conservative here to avoid
-// unnecessary error reporting.
-const timeoutConfiguration = { response: 1500 }
+// set to 500ms and then 1500ms. Let's be more conservative here to
+// avoid unnecessary error reporting during occasional slow responses.
+const timeoutConfiguration = { response: 3000 }
+
+// Monitoring thresholds for logging response times
+// Log warnings when responses exceed half the timeout threshold
+const WARN_RESPONSE_THRESHOLD = timeoutConfiguration.response / 2 // 1500ms
+// Log info for responses that are noticeably slow but not concerning
+const SLOW_RESPONSE_THRESHOLD = 500 // ms
// This module handles requests for deprecated GitHub Enterprise versions
// by routing them to static content in
@@ -201,10 +210,44 @@ export default async function archivedEnterpriseVersions(
)
const statsdTags = [`version:${requestedVersion}`]
+ const startTime = Date.now()
const r = await statsd.asyncTimer(doGet, 'archive_enterprise_proxy', [
...statsdTags,
`path:${req.path}`,
])()
+ const responseTime = Date.now() - startTime
+
+ // Log warnings for slow responses to help identify degraded performance
+ // A response time over half the timeout indicates potential issues
+ if (responseTime > WARN_RESPONSE_THRESHOLD) {
+ logger.warn('Slow response from archived enterprise content', {
+ version: requestedVersion,
+ path: req.path,
+ responseTime: `${responseTime}ms`,
+ status: r.status,
+ threshold: `${WARN_RESPONSE_THRESHOLD}ms`,
+ })
+ }
+
+ // Log errors for non-200 responses to help identify issues with archived content
+ if (r.status !== 200) {
+ logger.error('Failed to fetch archived enterprise content', {
+ version: requestedVersion,
+ path: req.path,
+ status: r.status,
+ responseTime: `${responseTime}ms`,
+ url: getProxyPath(req.path, requestedVersion),
+ })
+ }
+
+ // Log successful responses with timing for monitoring trends
+ if (r.status === 200 && responseTime > SLOW_RESPONSE_THRESHOLD) {
+ logger.info('Archived enterprise content response', {
+ version: requestedVersion,
+ responseTime: `${responseTime}ms`,
+ status: r.status,
+ })
+ }
if (r.status === 200) {
const body = await r.text()
@@ -317,6 +360,7 @@ export default async function archivedEnterpriseVersions(
return res.send(modifiedBody)
}
+
// In releases 2.13 - 2.17, we lost access to frontmatter redirects
// during the archival process. This workaround finds potentially
// relevant frontmatter redirects in currently supported pages
diff --git a/src/article-api/README.md b/src/article-api/README.md
index fd9b26a1d5cb..98667b88e554 100644
--- a/src/article-api/README.md
+++ b/src/article-api/README.md
@@ -13,12 +13,26 @@ Article API endpoints allow consumers to query GitHub Docs for listings of curre
The `/api/article/meta` endpoint powers hovercards, which provide a preview for internal links on .
+The `/api/article/body` endpoint can serve markdown for both regular articles and autogenerated content (such as REST API documentation) using specialized transformers.
+
## How it works
The `/api/article` endpoints return information about a page by `pathname`.
`api/article/meta` is highly cached, in JSON format.
+### Autogenerated Content Transformers
+
+For autogenerated pages (REST, GraphQL, webhooks, landing pages, audit logs, etc), the Article API uses specialized transformers to convert the rendered content into markdown format. These transformers are located in `src/article-api/transformers/` and use an extensible architecture.
+
+#### Transformers
+
+To add a new transformer for other autogenerated content types:
+1. Create a new transformer file implementing the `PageTransformer` interface
+2. Register it in `transformers/index.ts`
+3. Create a template in `templates/` to configure how the transformer will organize the autogenerated content
+4. The transformer will automatically be used by `/api/article/body`
+
## How to get help
For internal folks ask in the Docs Engineering slack channel.
@@ -34,12 +48,13 @@ Get article metadata and content in a single object. Equivalent to calling `/art
**Parameters**:
- **pathname** (string) - Article path (e.g. '/en/get-started/article-name')
+- **[apiVersion]** (string) - API version for REST pages (optional, defaults to latest)
**Returns**: (object) - JSON object with article metadata and content (`meta` and `body` keys)
**Throws**:
- (Error): 403 - If the article body cannot be retrieved. Reason is given in the error message.
-- (Error): 400 - If pathname parameter is invalid.
+- (Error): 400 - If pathname or apiVersion parameters are invalid.
- (Error): 404 - If the path is valid, but the page couldn't be resolved.
**Example**:
@@ -63,12 +78,13 @@ Get the contents of an article's body.
**Parameters**:
- **pathname** (string) - Article path (e.g. '/en/get-started/article-name')
+- **[apiVersion]** (string) - API version (optional, defaults to latest)
**Returns**: (string) - Article body content in markdown format.
**Throws**:
- (Error): 403 - If the article body cannot be retrieved. Reason is given in the error message.
-- (Error): 400 - If pathname parameter is invalid.
+- (Error): 400 - If pathname or apiVersion parameters are invalid.
- (Error): 404 - If the path is valid, but the page couldn't be resolved.
**Example**:
@@ -149,3 +165,34 @@ A list of pages available for a fully qualified path containing the target langu
---
+
+## Local Development
+
+### Bootstrap steps
+
+1. Start the dev server:
+ ```bash
+ npm run dev
+ ```
+
+2. Test API endpoints locally:
+ ```bash
+ curl http://localhost:4000/api/article/meta?pathname=/en/get-started
+ curl http://localhost:4000/api/article/body?pathname=/en/get-started
+ curl http://localhost:4000/api/pagelist/en/free-pro-team@latest
+ ```
+
+### Running tests
+
+```bash
+npm run test -- src/article-api/tests
+```
+
+## Ownership
+
+- Team: Docs Engineering
+
+### Known limitations
+- Cache invalidation is manual
+- No built-in rate limiting (uses Fastly instead)
+- Limited API versioning
diff --git a/src/article-api/lib/get-all-toc-items.ts b/src/article-api/lib/get-all-toc-items.ts
new file mode 100644
index 000000000000..51070a24ccd6
--- /dev/null
+++ b/src/article-api/lib/get-all-toc-items.ts
@@ -0,0 +1,127 @@
+import type { Context, Page } from '@/types'
+import type { LinkData } from '@/article-api/transformers/types'
+import { resolvePath } from './resolve-path'
+
+interface PageWithChildren extends Page {
+ children?: string[]
+ category?: string[]
+}
+
+interface TocItem extends LinkData {
+ category?: string[]
+ childTocItems?: TocItem[]
+}
+
+/**
+ * Recursively gathers all TOC items from a page and its descendants.
+ * This mirrors the behavior of getTocItems() in the generic-toc middleware
+ * but works with the page.children frontmatter property.
+ *
+ * @param page - The page to gather TOC items from
+ * @param context - The rendering context
+ * @param options - Configuration options
+ * @returns Array of TocItems with nested childTocItems
+ */
+export async function getAllTocItems(
+ page: Page,
+ context: Context,
+ options: {
+ recurse?: boolean
+ renderIntros?: boolean
+ } = {},
+): Promise {
+ const { recurse = true, renderIntros = true } = options
+ const pageWithChildren = page as PageWithChildren
+ const languageCode = page.languageCode || 'en'
+
+ if (!pageWithChildren.children || pageWithChildren.children.length === 0) {
+ return []
+ }
+
+ // Get the page's pathname for resolving children
+ const pagePermalink = page.permalinks.find(
+ (p) => p.languageCode === languageCode && p.pageVersion === context.currentVersion,
+ )
+ const pathname = pagePermalink ? pagePermalink.href : `/${languageCode}`
+
+ const items: TocItem[] = []
+
+ for (const childHref of pageWithChildren.children) {
+ const childPage = resolvePath(childHref, languageCode, pathname, context) as
+ | PageWithChildren
+ | undefined
+
+ if (!childPage) continue
+
+ const title = await childPage.renderTitle(context, { unwrap: true })
+ const intro =
+ renderIntros && childPage.intro
+ ? await childPage.renderProp('intro', context, { textOnly: true })
+ : ''
+
+ const childPermalink = childPage.permalinks.find(
+ (p) => p.languageCode === languageCode && p.pageVersion === context.currentVersion,
+ )
+ const href = childPermalink ? childPermalink.href : childHref
+
+ const category = childPage.category || []
+
+ const item: TocItem = {
+ href,
+ title,
+ intro,
+ category,
+ childTocItems: [],
+ }
+
+ // Recursively get children if enabled
+ if (recurse && childPage.children && childPage.children.length > 0) {
+ item.childTocItems = await getAllTocItems(childPage, context, options)
+ }
+
+ items.push(item)
+ }
+
+ return items
+}
+
+/**
+ * Flattens nested TOC items into a single array.
+ * Only includes leaf nodes (items without children) or all items based on options.
+ *
+ * @param tocItems - The nested TOC items to flatten
+ * @param options - Configuration options
+ * @returns Flat array of LinkData items
+ */
+export function flattenTocItems(
+ tocItems: TocItem[],
+ options: {
+ excludeParents?: boolean // If true, only include items without children
+ } = {},
+): LinkData[] {
+ const { excludeParents = true } = options
+ const result: LinkData[] = []
+
+ function recurse(items: TocItem[]) {
+ for (const item of items) {
+ const hasChildren = item.childTocItems && item.childTocItems.length > 0
+
+ // Include this item if it's a leaf or if we're including parents
+ if (!hasChildren || !excludeParents) {
+ result.push({
+ href: item.href,
+ title: item.title,
+ intro: item.intro,
+ })
+ }
+
+ // Recurse into children
+ if (hasChildren) {
+ recurse(item.childTocItems!)
+ }
+ }
+ }
+
+ recurse(tocItems)
+ return result
+}
diff --git a/src/article-api/lib/get-link-data.ts b/src/article-api/lib/get-link-data.ts
new file mode 100644
index 000000000000..f9c33c74608e
--- /dev/null
+++ b/src/article-api/lib/get-link-data.ts
@@ -0,0 +1,48 @@
+import type { Context, Page } from '@/types'
+import type { LinkData } from '@/article-api/transformers/types'
+
+/**
+ * Resolves link data (title, href, intro) for a given href and page
+ *
+ * This helper is used by landing page transformers to build link lists.
+ * It resolves the page from an href, renders its title and intro, and
+ * returns the canonical permalink.
+ *
+ * @param href - The href to resolve (can be relative or absolute)
+ * @param languageCode - The language code for the current page
+ * @param pathname - The current page's pathname (for relative resolution)
+ * @param context - The rendering context
+ * @param resolvePath - Function to resolve an href to a Page object
+ * @returns LinkData with resolved title, href, and optional intro
+ */
+export async function getLinkData(
+ href: string,
+ languageCode: string,
+ pathname: string,
+ context: Context,
+ resolvePath: (
+ href: string,
+ languageCode: string,
+ pathname: string,
+ context: Context,
+ ) => Page | undefined,
+): Promise {
+ const linkedPage = resolvePath(href, languageCode, pathname, context)
+ if (!linkedPage) return { href, title: href }
+
+ const title = await linkedPage.renderTitle(context, { unwrap: true })
+ const intro = linkedPage.intro
+ ? await linkedPage.renderProp('intro', context, { textOnly: true })
+ : ''
+
+ const permalink = linkedPage.permalinks.find(
+ (p) => p.languageCode === languageCode && p.pageVersion === context.currentVersion,
+ )
+ const resolvedHref = permalink ? permalink.href : href
+
+ return {
+ href: resolvedHref,
+ title,
+ intro,
+ }
+}
diff --git a/src/article-api/lib/graphql-helpers.ts b/src/article-api/lib/graphql-helpers.ts
new file mode 100644
index 000000000000..6db482d7ff06
--- /dev/null
+++ b/src/article-api/lib/graphql-helpers.ts
@@ -0,0 +1,32 @@
+import type { Context, Page } from '@/types'
+import { renderContent } from '@/content-render/index'
+import matter from '@gr2m/gray-matter'
+
+/**
+ * Extract manual content from page markdown
+ * Used by GraphQL transformers to get content before the auto-generated marker
+ */
+export async function extractManualContent(page: Page, context: Context): Promise {
+ if (!page.markdown) return ''
+
+ const markerIndex = page.markdown.indexOf(
+ '',
+ )
+
+ if (markerIndex <= 0) return ''
+
+ const { content } = matter(page.markdown)
+ const manualContentMarkerIndex = content.indexOf(
+ '',
+ )
+
+ if (manualContentMarkerIndex <= 0) return ''
+
+ const rawManualContent = content.substring(0, manualContentMarkerIndex).trim()
+ if (!rawManualContent) return ''
+
+ return await renderContent(rawManualContent, {
+ ...context,
+ markdownRequested: true,
+ })
+}
diff --git a/src/article-api/lib/load-template.ts b/src/article-api/lib/load-template.ts
new file mode 100644
index 000000000000..2cf169ba791b
--- /dev/null
+++ b/src/article-api/lib/load-template.ts
@@ -0,0 +1,31 @@
+import { readFileSync } from 'fs'
+import { join, dirname } from 'path'
+import { fileURLToPath } from 'url'
+
+// Get the directory path for the transformers directory
+// This will be used to resolve template paths relative to transformers
+const __filename = fileURLToPath(import.meta.url)
+const __dirname = dirname(__filename)
+
+/**
+ * Load a template file from the templates directory
+ *
+ * This helper loads Liquid template files used by transformers.
+ * Templates are located in src/article-api/templates/
+ *
+ * @param templateName - The name of the template file (e.g., 'landing-page.template.md')
+ * @returns The template content as a string
+ *
+ * @example
+ * ```typescript
+ * const template = loadTemplate('landing-page.template.md')
+ * const rendered = await renderContent(template, context)
+ * ```
+ */
+export function loadTemplate(templateName: string): string {
+ // Templates are in ../templates relative to the lib directory
+ // lib is at src/article-api/lib
+ // templates is at src/article-api/templates
+ const templatePath = join(__dirname, '../templates', templateName)
+ return readFileSync(templatePath, 'utf8')
+}
diff --git a/src/article-api/lib/resolve-path.ts b/src/article-api/lib/resolve-path.ts
new file mode 100644
index 000000000000..88acc8f618b1
--- /dev/null
+++ b/src/article-api/lib/resolve-path.ts
@@ -0,0 +1,107 @@
+import type { Context, Page } from '@/types'
+
+/**
+ * Resolves an href to a Page object from the context
+ *
+ * This function handles various href formats:
+ * - External URLs (http/https) - returns undefined
+ * - Language-prefixed absolute paths (/en/copilot/...) - direct lookup
+ * - Absolute paths without language (/copilot/...) - adds language prefix
+ * - Relative paths (get-started) - resolved relative to pathname
+ *
+ * The function searches through context.pages using multiple strategies:
+ * 1. Direct key lookup with language prefix
+ * 2. Relative path joining with current pathname
+ * 3. endsWith matching for versioned keys (e.g., /en/enterprise-cloud@latest/...)
+ *
+ * @param href - The href to resolve
+ * @param languageCode - The language code (e.g., 'en')
+ * @param pathname - The current page's pathname (e.g., '/en/copilot')
+ * @param context - The rendering context containing all pages
+ * @returns The resolved Page object, or undefined if not found
+ *
+ * @example
+ * ```typescript
+ * // Absolute path with language
+ * resolvePath('/en/copilot/quickstart', 'en', '/en/copilot', context)
+ *
+ * // Absolute path without language (adds /en/)
+ * resolvePath('/copilot/quickstart', 'en', '/en/copilot', context)
+ *
+ * // Relative path (resolves to /en/copilot/quickstart)
+ * resolvePath('quickstart', 'en', '/en/copilot', context)
+ *
+ * // Relative path with leading slash (resolves relative to pathname)
+ * resolvePath('/quickstart', 'en', '/en/copilot', context) // -> /en/copilot/quickstart
+ * ```
+ */
+export function resolvePath(
+ href: string,
+ languageCode: string,
+ pathname: string,
+ context: Context,
+): Page | undefined {
+ // External URLs cannot be resolved
+ if (href.startsWith('http://') || href.startsWith('https://')) {
+ return undefined
+ }
+
+ if (!context.pages) {
+ return undefined
+ }
+
+ // Normalize href to start with /
+ const normalizedHref = href.startsWith('/') ? href : `/${href}`
+
+ // Build full path with language prefix if needed
+ let fullPath: string
+ if (normalizedHref.startsWith(`/${languageCode}/`)) {
+ // Already has language prefix
+ fullPath = normalizedHref
+ } else if (href.startsWith('/') && !href.startsWith(`/${languageCode}/`)) {
+ // Path with leading slash but no language prefix - treat as relative to pathname
+ // e.g., pathname='/en/copilot', href='/get-started' -> '/en/copilot/get-started'
+ fullPath = pathname + href
+ } else {
+ // Relative path - add language prefix
+ // e.g., href='quickstart' -> '/en/quickstart'
+ fullPath = `/${languageCode}${normalizedHref}`
+ }
+
+ // Clean up trailing slashes
+ const cleanPath = fullPath.replace(/\/$/, '')
+
+ // Strategy 1: Direct lookup
+ if (context.pages[cleanPath]) {
+ return context.pages[cleanPath]
+ }
+
+ // Strategy 2: Try relative to current pathname
+ const currentPath = pathname.replace(/\/$/, '')
+ const relativeHref = href.startsWith('/') ? href.slice(1) : href
+ const joinedPath = `${currentPath}/${relativeHref}`
+
+ if (context.pages[joinedPath]) {
+ return context.pages[joinedPath]
+ }
+
+ // Strategy 3: Search for keys that end with the path (handles versioned keys)
+ // e.g., key='/en/enterprise-cloud@latest/copilot' should match path='/en/copilot'
+ for (const [key, page] of Object.entries(context.pages)) {
+ if (key.endsWith(cleanPath) || key.endsWith(`${cleanPath}/`)) {
+ return page
+ }
+ }
+
+ // Strategy 4: If href started with /, try endsWith matching on that too
+ if (href.startsWith('/')) {
+ const hrefClean = href.replace(/\/$/, '')
+ for (const [key, page] of Object.entries(context.pages)) {
+ if (key.endsWith(hrefClean) || key.endsWith(`${hrefClean}/`)) {
+ return page
+ }
+ }
+ }
+
+ return undefined
+}
diff --git a/src/article-api/lib/strip-html-comments.ts b/src/article-api/lib/strip-html-comments.ts
new file mode 100644
index 000000000000..354bef9b0b63
--- /dev/null
+++ b/src/article-api/lib/strip-html-comments.ts
@@ -0,0 +1,31 @@
+/**
+ * Strips HTML comments from markdown content.
+ * Removes single-line HTML comments like
+ * while preserving other content.
+ *
+ * @param content - The markdown content to process
+ * @returns The content with HTML comments removed
+ */
+export function stripHtmlComments(content: string): string {
+ // Remove single-line HTML comments ()
+ // This matches comments that are on their own line or inline
+ return content.replace(//g, '').trim()
+}
+
+/**
+ * Strips HTML comments and cleans up extra blank lines.
+ * Useful for cleaning up rendered markdown content where HTML comments
+ * were on separate lines and their removal creates gaps.
+ *
+ * @param content - The markdown content to process
+ * @returns The content with HTML comments removed and blank lines normalized
+ */
+export function stripHtmlCommentsAndNormalizeWhitespace(content: string): string {
+ // Remove HTML comments
+ let cleaned = stripHtmlComments(content)
+
+ // Normalize multiple consecutive blank lines to at most 2 blank lines
+ cleaned = cleaned.replace(/\n{3,}/g, '\n\n')
+
+ return cleaned.trim()
+}
diff --git a/src/article-api/liquid-renderers/index.ts b/src/article-api/liquid-renderers/index.ts
new file mode 100644
index 000000000000..b25734dbad69
--- /dev/null
+++ b/src/article-api/liquid-renderers/index.ts
@@ -0,0 +1,16 @@
+/**
+ * API Transformer Liquid Tags
+ *
+ * This module contains custom Liquid tags used by article-api transformers
+ * to render API documentation in a consistent format.
+ */
+
+import { restTags } from './rest-tags'
+
+// Export all API transformer tags for registration
+export const apiTransformerTags = {
+ ...restTags,
+}
+
+// Re-export individual tag modules for direct access if needed
+export { restTags } from './rest-tags'
diff --git a/src/article-api/liquid-renderers/rest-tags.ts b/src/article-api/liquid-renderers/rest-tags.ts
new file mode 100644
index 000000000000..864644287a87
--- /dev/null
+++ b/src/article-api/liquid-renderers/rest-tags.ts
@@ -0,0 +1,230 @@
+import type { TagToken, Context as LiquidContext } from 'liquidjs'
+import { fastTextOnly } from '@/content-render/unified/text-only'
+import { renderContent } from '@/content-render/index'
+import type { Context } from '@/types'
+import type { Parameter, BodyParameter, ChildParameter, StatusCode } from '@/rest/components/types'
+import { createLogger } from '@/observability/logger'
+
+const logger = createLogger('article-api/liquid-renderers/rest-tags')
+
+/**
+ * Custom Liquid tag for rendering REST API parameters
+ * Usage: {% rest_parameter param %}
+ */
+export class RestParameter {
+ private paramName: string
+
+ constructor(
+ token: TagToken,
+ remainTokens: TagToken[],
+ liquid: { options: any; parser: any },
+ private liquidContext?: LiquidContext,
+ ) {
+ // The tag receives the parameter object from the template context
+ this.paramName = token.args.trim()
+ }
+
+ async render(ctx: LiquidContext, emitter: any): Promise {
+ const param = ctx.get([this.paramName]) as Parameter
+ const context = ctx.get(['context']) as Context
+
+ if (!param) {
+ emitter.write('')
+ return
+ }
+
+ const lines: string[] = []
+ const required = param.required ? ' (required)' : ''
+ const type = param.schema?.type || 'string'
+
+ lines.push(`- **\`${param.name}\`** (${type})${required}`)
+
+ if (param.description) {
+ const description = await htmlToMarkdown(param.description, context)
+ lines.push(` ${description}`)
+ }
+
+ if (param.schema?.default !== undefined) {
+ lines.push(` Default: \`${param.schema.default}\``)
+ }
+
+ if (param.schema?.enum && param.schema.enum.length > 0) {
+ lines.push(` Can be one of: ${param.schema.enum.map((v) => `\`${v}\``).join(', ')}`)
+ }
+
+ emitter.write(lines.join('\n'))
+ }
+}
+
+/**
+ * Custom Liquid tag for rendering REST API body parameters
+ * Usage: {% rest_body_parameter param indent %}
+ */
+export class RestBodyParameter {
+ constructor(
+ token: TagToken,
+ remainTokens: TagToken[],
+ liquid: { options: any; parser: any },
+ private liquidContext?: LiquidContext,
+ ) {
+ // Parse arguments - param name and optional indent level
+ const args = token.args.trim().split(/\s+/)
+ this.param = args[0]
+ this.indent = args[1] ? parseInt(args[1]) : 0
+ }
+
+ private param: string
+ private indent: number
+
+ async render(ctx: LiquidContext, emitter: any): Promise {
+ const param = ctx.get([this.param]) as BodyParameter
+ const context = ctx.get(['context']) as Context
+ const indent = this.indent
+
+ if (!param) {
+ emitter.write('')
+ return
+ }
+
+ const lines: string[] = []
+ const prefix = ' '.repeat(indent)
+ const required = param.isRequired ? ' (required)' : ''
+ const type = param.type || 'string'
+
+ lines.push(`${prefix}- **\`${param.name}\`** (${type})${required}`)
+
+ if (param.description) {
+ const description = await htmlToMarkdown(param.description, context)
+ lines.push(`${prefix} ${description}`)
+ }
+
+ if (param.default !== undefined) {
+ lines.push(`${prefix} Default: \`${param.default}\``)
+ }
+
+ if (param.enum && param.enum.length > 0) {
+ lines.push(`${prefix} Can be one of: ${param.enum.map((v) => `\`${v}\``).join(', ')}`)
+ }
+
+ // Handle nested parameters
+ if (param.childParamsGroups && param.childParamsGroups.length > 0) {
+ for (const childGroup of param.childParamsGroups) {
+ lines.push(await renderChildParameter(childGroup, context, indent + 1))
+ }
+ }
+
+ emitter.write(lines.join('\n'))
+ }
+}
+
+/**
+ * Custom Liquid tag for rendering REST API status codes
+ * Usage: {% rest_status_code statusCode %}
+ */
+export class RestStatusCode {
+ private statusCodeName: string
+
+ constructor(
+ token: TagToken,
+ remainTokens: TagToken[],
+ liquid: { options: any; parser: any },
+ private liquidContext?: LiquidContext,
+ ) {
+ this.statusCodeName = token.args.trim()
+ }
+
+ async render(ctx: LiquidContext, emitter: any): Promise {
+ const statusCode = ctx.get([this.statusCodeName]) as StatusCode
+ const context = ctx.get(['context']) as Context
+
+ if (!statusCode) {
+ emitter.write('')
+ return
+ }
+
+ const lines: string[] = []
+
+ if (statusCode.description) {
+ const description = await htmlToMarkdown(statusCode.description, context)
+ lines.push(`- **${statusCode.httpStatusCode}**`)
+ if (description.trim()) {
+ lines.push(` ${description.trim()}`)
+ }
+ } else if (statusCode.httpStatusMessage) {
+ lines.push(`- **${statusCode.httpStatusCode}** - ${statusCode.httpStatusMessage}`)
+ } else {
+ lines.push(`- **${statusCode.httpStatusCode}**`)
+ }
+
+ emitter.write(lines.join('\n'))
+ }
+}
+
+/**
+ * Helper function to render child parameters recursively
+ */
+async function renderChildParameter(
+ param: ChildParameter,
+ context: Context,
+ indent: number,
+): Promise {
+ const lines: string[] = []
+ const prefix = ' '.repeat(indent)
+ const required = param.isRequired ? ' (required)' : ''
+ const type = param.type || 'string'
+
+ lines.push(`${prefix}- **\`${param.name}\`** (${type})${required}`)
+
+ if (param.description) {
+ const description = await htmlToMarkdown(param.description, context)
+ lines.push(`${prefix} ${description}`)
+ }
+
+ if (param.default !== undefined) {
+ lines.push(`${prefix} Default: \`${param.default}\``)
+ }
+
+ if (param.enum && param.enum.length > 0) {
+ lines.push(`${prefix} Can be one of: ${param.enum.map((v: string) => `\`${v}\``).join(', ')}`)
+ }
+
+ // Recursively handle nested parameters
+ if (param.childParamsGroups && param.childParamsGroups.length > 0) {
+ for (const child of param.childParamsGroups) {
+ lines.push(await renderChildParameter(child, context, indent + 1))
+ }
+ }
+
+ return lines.join('\n')
+}
+
+/**
+ * Helper function to convert HTML to markdown
+ */
+async function htmlToMarkdown(html: string, context: Context): Promise {
+ if (!html) return ''
+
+ try {
+ const rendered = await renderContent(html, context, { textOnly: false })
+ return fastTextOnly(rendered)
+ } catch (error) {
+ logger.error('Failed to render HTML content to markdown in REST tag', {
+ error,
+ html: html.substring(0, 100), // First 100 chars for context
+ contextInfo: context && context.page ? { page: context.page.relativePath } : undefined,
+ })
+ // In non-production, re-throw to aid debugging
+ if (process.env.NODE_ENV !== 'production') {
+ throw error
+ }
+ // Fallback to simple text extraction
+ return fastTextOnly(html)
+ }
+}
+
+// Export tag names for registration
+export const restTags = {
+ rest_parameter: RestParameter,
+ rest_body_parameter: RestBodyParameter,
+ rest_status_code: RestStatusCode,
+}
diff --git a/src/article-api/middleware/article-body.ts b/src/article-api/middleware/article-body.ts
index 8ed00fa67ecb..c6b82b59f627 100644
--- a/src/article-api/middleware/article-body.ts
+++ b/src/article-api/middleware/article-body.ts
@@ -3,20 +3,16 @@ import type { Response } from 'express'
import { Context } from '@/types'
import { ExtendedRequestWithPageInfo } from '@/article-api/types'
import contextualize from '@/frame/middleware/context/context'
+import features from '@/versions/middleware/features'
+import { transformerRegistry } from '@/article-api/transformers'
+import { allVersions } from '@/versions/lib/all-versions'
+import type { Page } from '@/types'
-export async function getArticleBody(req: ExtendedRequestWithPageInfo) {
- // req.pageinfo is set from pageValidationMiddleware and pathValidationMiddleware
- // and is in the ExtendedRequestWithPageInfo
- const { page, pathname, archived } = req.pageinfo
-
- if (archived?.isArchived)
- throw new Error(`Page ${pathname} is archived and can't be rendered in markdown.`)
- // for anything that's not an article (like index pages), don't try to render and
- // tell the user what's going on
- if (page.documentType !== 'article') {
- throw new Error(`Page ${pathname} isn't yet available in markdown.`)
- }
- // these parts allow us to render the page
+/**
+ * Creates a mocked rendering request and contextualizes it.
+ * This is used to prepare a request for rendering pages in markdown format.
+ */
+async function createContextualizedRenderingRequest(pathname: string, page: Page) {
const mockedContext: Context = {}
const renderingReq = {
path: pathname,
@@ -29,9 +25,69 @@ export async function getArticleBody(req: ExtendedRequestWithPageInfo) {
},
}
- // contextualize and render the page
+ // contextualize the request to get proper version info
await contextualize(renderingReq as ExtendedRequestWithPageInfo, {} as Response, () => {})
renderingReq.context.page = page
+
+ // Load feature flags into context (needed for {% ifversion %} tags)
+ features(renderingReq as ExtendedRequestWithPageInfo, {} as Response, () => {})
+
+ return renderingReq
+}
+
+export async function getArticleBody(req: ExtendedRequestWithPageInfo) {
+ // req.pageinfo is set from pageValidationMiddleware and pathValidationMiddleware
+ // and is in the ExtendedRequestWithPageInfo
+ const { page, pathname, archived } = req.pageinfo
+
+ if (archived?.isArchived)
+ throw new Error(`Page ${pathname} is archived and can't be rendered in markdown.`)
+
+ // Extract apiVersion from query params if provided
+ const apiVersion = req.query.apiVersion as string | undefined
+
+ // Check if there's a transformer for this page type (e.g., REST, webhooks, etc.)
+ const transformer = transformerRegistry.findTransformer(page)
+
+ if (transformer) {
+ // Use the transformer for autogenerated pages
+ const renderingReq = await createContextualizedRenderingRequest(pathname, page)
+
+ // Determine the API version to use (provided or latest)
+ // Validation is handled by apiVersionValidationMiddleware
+ const currentVersion = renderingReq.context.currentVersion
+ let effectiveApiVersion = apiVersion
+
+ // Use latest version if not provided
+ if (!effectiveApiVersion && currentVersion && allVersions[currentVersion]) {
+ effectiveApiVersion = allVersions[currentVersion].latestApiVersion || undefined
+ }
+
+ return await transformer.transform(page, pathname, renderingReq.context, effectiveApiVersion)
+ }
+
+ // For regular articles (non-autogenerated)
+ if (page.documentType !== 'article') {
+ throw new Error(`Page ${pathname} isn't yet available in markdown.`)
+ }
+
+ // these parts allow us to render the page
+ const renderingReq = await createContextualizedRenderingRequest(pathname, page)
renderingReq.context.markdownRequested = true
- return await page.render(renderingReq.context)
+ const content = await page.render(renderingReq.context)
+
+ // Get title and intro for consistency with transformer-based pages
+ const title = page.title
+ const intro = page.intro
+ ? await page.renderProp('intro', renderingReq.context, { textOnly: true })
+ : ''
+
+ // Prepend title and intro to the content
+ let result = `# ${title}\n\n`
+ if (intro) {
+ result += `${intro}\n\n`
+ }
+ result += content
+
+ return result
}
diff --git a/src/article-api/middleware/article-pageinfo.ts b/src/article-api/middleware/article-pageinfo.ts
index b9d45d80bd59..87f648821792 100644
--- a/src/article-api/middleware/article-pageinfo.ts
+++ b/src/article-api/middleware/article-pageinfo.ts
@@ -100,7 +100,7 @@ export async function getPageInfoFromCache(page: Page, pathname: string) {
cacheInfo = 'initial-load'
} catch (error) {
cacheInfo = 'initial-fail'
- if (error instanceof Error && (error as any).code !== 'ENOENT') {
+ if (error instanceof Error && (error as NodeJS.ErrnoException).code !== 'ENOENT') {
throw error
}
_cache = {}
diff --git a/src/article-api/middleware/article.ts b/src/article-api/middleware/article.ts
index 2d73067da152..713c5eb6790a 100644
--- a/src/article-api/middleware/article.ts
+++ b/src/article-api/middleware/article.ts
@@ -4,7 +4,11 @@ import express from 'express'
import { defaultCacheControl } from '@/frame/middleware/cache-control'
import catchMiddlewareError from '@/observability/middleware/catch-middleware-error'
import { ExtendedRequestWithPageInfo } from '../types'
-import { pageValidationMiddleware, pathValidationMiddleware } from './validation'
+import {
+ pageValidationMiddleware,
+ pathValidationMiddleware,
+ apiVersionValidationMiddleware,
+} from './validation'
import { getArticleBody } from './article-body'
import { getMetadata } from './article-pageinfo'
import {
@@ -24,9 +28,10 @@ const router = express.Router()
* Get article metadata and content in a single object. Equivalent to calling `/article/meta` concatenated with `/article/body`.
* @route GET /api/article
* @param {string} pathname - Article path (e.g. '/en/get-started/article-name')
+ * @param {string} [apiVersion] - API version for REST pages (optional, defaults to latest)
* @returns {object} JSON object with article metadata and content (`meta` and `body` keys)
* @throws {Error} 403 - If the article body cannot be retrieved. Reason is given in the error message.
- * @throws {Error} 400 - If pathname parameter is invalid.
+ * @throws {Error} 400 - If pathname or apiVersion parameters are invalid.
* @throws {Error} 404 - If the path is valid, but the page couldn't be resolved.
* @example
* āÆ curl -s "https://docs.github.com/api/article?pathname=/en/get-started/start-your-journey/about-github-and-git"
@@ -43,6 +48,7 @@ router.get(
'/',
pathValidationMiddleware as RequestHandler,
pageValidationMiddleware as RequestHandler,
+ apiVersionValidationMiddleware as RequestHandler,
catchMiddlewareError(async function (req: ExtendedRequestWithPageInfo, res: Response) {
const { meta, cacheInfo } = await getMetadata(req)
let bodyContent
@@ -66,9 +72,10 @@ router.get(
* Get the contents of an article's body.
* @route GET /api/article/body
* @param {string} pathname - Article path (e.g. '/en/get-started/article-name')
+ * @param {string} [apiVersion] - API version (optional, defaults to latest)
* @returns {string} Article body content in markdown format.
* @throws {Error} 403 - If the article body cannot be retrieved. Reason is given in the error message.
- * @throws {Error} 400 - If pathname parameter is invalid.
+ * @throws {Error} 400 - If pathname or apiVersion parameters are invalid.
* @throws {Error} 404 - If the path is valid, but the page couldn't be resolved.
* @example
* āÆ curl -s https://docs.github.com/api/article/body\?pathname=/en/get-started/start-your-journey/about-github-and-git
@@ -83,6 +90,7 @@ router.get(
'/body',
pathValidationMiddleware as RequestHandler,
pageValidationMiddleware as RequestHandler,
+ apiVersionValidationMiddleware as RequestHandler,
catchMiddlewareError(async function (req: ExtendedRequestWithPageInfo, res: Response) {
let bodyContent
try {
@@ -164,11 +172,19 @@ function incrementArticleLookup(
// logs the source of the request, if it's for hovercards it'll have the header X-Request-Source.
// see src/links/components/LinkPreviewPopover.tsx
- const source =
- req.get('X-Request-Source') ||
- (req.get('Referer')
- ? `external-${new URL(req.get('Referer') || '').hostname || 'unknown'}`
- : 'external')
+ let source = req.get('X-Request-Source')
+ if (!source) {
+ const referer = req.get('Referer')
+ if (referer) {
+ try {
+ source = `external-${new URL(referer).hostname || 'unknown'}`
+ } catch {
+ source = 'external'
+ }
+ } else {
+ source = 'external'
+ }
+ }
const tags = [
// According to https://docs.datadoghq.com/getting_started/tagging/#define-tags
diff --git a/src/article-api/middleware/validation.ts b/src/article-api/middleware/validation.ts
index 1a92afff647b..6ef27385ccc9 100644
--- a/src/article-api/middleware/validation.ts
+++ b/src/article-api/middleware/validation.ts
@@ -6,6 +6,7 @@ import { isArchivedVersionByPath } from '@/archives/lib/is-archived-version'
import getRedirect from '@/redirects/lib/get-redirect'
import { getVersionStringFromPath, getLangFromPath } from '@/frame/lib/path-utils'
import nonEnterpriseDefaultVersion from '@/versions/lib/non-enterprise-default-version'
+import { allVersions } from '@/versions/lib/all-versions'
// validates the path for pagelist endpoint
// specifically, defaults to `/en/free-pro-team@latest` when those values are missing
@@ -123,3 +124,47 @@ export const pageValidationMiddleware = (
return next()
}
+
+export const apiVersionValidationMiddleware = (
+ req: ExtendedRequestWithPageInfo,
+ res: Response,
+ next: NextFunction,
+) => {
+ const apiVersion = req.query.apiVersion as string | string[] | undefined
+
+ // If no apiVersion is provided, continue (it will default to latest)
+ if (!apiVersion) {
+ return next()
+ }
+
+ // Validate apiVersion is a single string, not an array
+ if (Array.isArray(apiVersion)) {
+ return res.status(400).json({ error: "Multiple 'apiVersion' keys" })
+ }
+
+ // Get the version from the pathname query parameter
+ const pathname = req.pageinfo?.pathname || (req.query.pathname as string)
+ if (!pathname) {
+ // This should not happen as pathValidationMiddleware runs first
+ throw new Error('pathname not available for apiVersion validation')
+ }
+
+ // Extract version from the pathname
+ const currentVersion = getVersionStringFromPath(pathname) || nonEnterpriseDefaultVersion
+ const versionInfo = allVersions[currentVersion]
+
+ if (!versionInfo) {
+ return res.status(400).json({ error: `Invalid version '${currentVersion}'` })
+ }
+
+ const validApiVersions = versionInfo.apiVersions || []
+
+ // If this version has API versioning, validate the provided version
+ if (validApiVersions.length > 0 && !validApiVersions.includes(apiVersion)) {
+ return res.status(400).json({
+ error: `Invalid apiVersion '${apiVersion}' for ${currentVersion}. Valid API versions are: ${validApiVersions.join(', ')}`,
+ })
+ }
+
+ return next()
+}
diff --git a/src/article-api/templates/audit-logs-page.template.md b/src/article-api/templates/audit-logs-page.template.md
new file mode 100644
index 000000000000..c91df5343cda
--- /dev/null
+++ b/src/article-api/templates/audit-logs-page.template.md
@@ -0,0 +1,30 @@
+# {{ page.title }}
+
+{{ page.intro }}
+
+{{ manualContent }}
+
+## Audit log events
+
+{% for categoryEntry in categorizedEvents %}
+{% assign categoryName = categoryEntry[0] %}
+{% assign events = categoryEntry[1] %}
+### {{ categoryName }}
+
+{% if categoryNotes[categoryName] %}
+{{ categoryNotes[categoryName] }}
+
+{% endif %}
+{% for event in events %}
+#### `{{ event.action }}`
+
+{{ event.description }}
+
+**Fields:** {% if event.fields %}{% for field in event.fields %}`{{ field }}`{% unless forloop.last %}, {% endunless %}{% endfor %}{% else %}No fields available{% endif %}
+
+{% if event.docs_reference_links and event.docs_reference_links != 'N/A' %}
+**Reference:** {{ event.docs_reference_links }}
+{% endif %}
+
+{% endfor %}
+{% endfor %}
\ No newline at end of file
diff --git a/src/article-api/templates/codeql-cli-page.template.md b/src/article-api/templates/codeql-cli-page.template.md
new file mode 100644
index 000000000000..a497a9dde462
--- /dev/null
+++ b/src/article-api/templates/codeql-cli-page.template.md
@@ -0,0 +1,7 @@
+# {{ page.title }}
+
+{% if page.intro %}
+{{ page.intro }}
+{% endif %}
+
+{{ content }}
diff --git a/src/article-api/templates/github-apps-page.template.md b/src/article-api/templates/github-apps-page.template.md
new file mode 100644
index 000000000000..f7b01c89e31b
--- /dev/null
+++ b/src/article-api/templates/github-apps-page.template.md
@@ -0,0 +1,25 @@
+# {{ page.title }}
+
+{% if page.intro %}
+{{ page.intro }}
+{% endif %}
+
+{% if manualContent %}
+{{ manualContent }}
+{% endif %}
+
+{% if isListPage %}
+{% comment %}
+Render endpoints as categorized bullet lists
+{% endcomment %}
+{% for item in items %}
+{% if item.operations.size > 0 %}
+## {{ item.category }}
+
+{% for operation in item.operations %}
+* [`{{ operation.verb }} {{ operation.requestPath }}`](/{{ currentLanguage }}/{% if currentVersion != 'free-pro-team@latest' %}{{ currentVersion }}/{% endif %}rest/{{ operation.category }}#{{ operation.slug }})
+{% endfor %}
+
+{% endif %}
+{% endfor %}
+{% endif %}
diff --git a/src/article-api/templates/graphql-breaking-changes.template.md b/src/article-api/templates/graphql-breaking-changes.template.md
new file mode 100644
index 000000000000..5bfa49a9d0f6
--- /dev/null
+++ b/src/article-api/templates/graphql-breaking-changes.template.md
@@ -0,0 +1,21 @@
+# {{ pageTitle }}
+
+{{ pageIntro }}
+
+{{ manualContent }}
+
+{% for change in breakingChangesByDate %}
+
+## {{ change.heading }}
+
+{% for item in change.items %}
+
+- {% if item.criticality == 'breaking' %}**Breaking**{% else %}**Dangerous**{% endif %} A change will be made to `{{ item.location }}`.
+
+ **Description:** {{ item.description }}
+
+ **Reason:** {{ item.reason }}
+
+{% endfor %}
+
+{% endfor %}
diff --git a/src/article-api/templates/graphql-changelog.template.md b/src/article-api/templates/graphql-changelog.template.md
new file mode 100644
index 000000000000..b1461930710f
--- /dev/null
+++ b/src/article-api/templates/graphql-changelog.template.md
@@ -0,0 +1,38 @@
+# {{ pageTitle }}
+
+{{ pageIntro }}
+
+{{ manualContent }}
+
+{% for item in changelogItems %}
+
+## Schema changes for {{ item.date }}
+
+{% for schemaChange in item.schemaChanges %}
+
+### {{ schemaChange.title }}
+
+{% for change in schemaChange.changes %}- {{ change }}
+{% endfor %}
+
+{% endfor %}
+
+{% for previewChange in item.previewChanges %}
+
+### {{ previewChange.title }}
+
+{% for change in previewChange.changes %}- {{ change }}
+{% endfor %}
+
+{% endfor %}
+
+{% for upcomingChange in item.upcomingChanges %}
+
+### {{ upcomingChange.title }}
+
+{% for change in upcomingChange.changes %}- {{ change }}
+{% endfor %}
+
+{% endfor %}
+
+{% endfor %}
diff --git a/src/article-api/templates/graphql-index.template.md b/src/article-api/templates/graphql-index.template.md
new file mode 100644
index 000000000000..dd2132c8d938
--- /dev/null
+++ b/src/article-api/templates/graphql-index.template.md
@@ -0,0 +1,9 @@
+# {{ pageTitle }}
+
+{{ pageIntro }}
+
+{{ manualContent }}
+
+## Reference pages
+
+{{ childrenLinks }}
diff --git a/src/article-api/templates/graphql-reference.template.md b/src/article-api/templates/graphql-reference.template.md
new file mode 100644
index 000000000000..955db8e5f295
--- /dev/null
+++ b/src/article-api/templates/graphql-reference.template.md
@@ -0,0 +1,120 @@
+# {{ pageTitle }}
+
+{{ pageIntro }}
+
+{{ manualContent }}
+
+{% for item in items %}
+
+## {{ item.name }}
+
+{{ item.description }}
+
+{% if item.isDeprecated %}
+
+> [!WARNING]
+> **Deprecation notice:** {{ item.deprecationReason }}
+{% endif %}
+
+{% if pageType == 'queries' %}
+**Type:** [{{ item.type }}]({{ item.href }})
+
+{% if item.args.size > 0 %}
+
+### Arguments for `{{ item.name }}`
+
+| Name | Type | Description |
+| --- | --- | --- |
+{% for arg in item.args %}| `{{ arg.name }}` | [`{{ arg.type }}`]({{ arg.href }}) | {{ arg.description }} |
+{% endfor %}
+{% endif %}
+
+{% elsif pageType == 'mutations' %}
+{% if item.inputFields.size > 0 %}
+
+### Input fields for `{{ item.name }}`
+
+| Name | Type | Description |
+| --- | --- | --- |
+{% for field in item.inputFields %}| `{{ field.name }}` | [`{{ field.type }}`]({{ field.href }}) | {{ field.description }}{% if field.defaultValue %} Default: `{{ field.defaultValue }}`.{% endif %} |
+{% endfor %}
+{% endif %}
+
+{% if item.returnFields.size > 0 %}
+
+### Return fields for `{{ item.name }}`
+
+| Name | Type | Description |
+| --- | --- | --- |
+{% for field in item.returnFields %}| `{{ field.name }}` | [`{{ field.type }}`]({{ field.href }}) | {{ field.description }}{% if field.defaultValue %} Default: `{{ field.defaultValue }}`.{% endif %}{% if field.isDeprecated %} **Deprecated:** {{ field.deprecationReason }}{% endif %} |
+{% endfor %}
+{% endif %}
+
+{% elsif pageType == 'objects' %}
+{% if item.implements.size > 0 %}
+
+### Implements
+
+{% for impl in item.implements %}- [`{{ impl.name }}`]({{ impl.href }})
+{% endfor %}
+{% endif %}
+
+{% if item.fields.size > 0 %}
+
+### Fields for `{{ item.name }}`
+
+| Name | Type | Description |
+| --- | --- | --- |
+{% for field in item.fields %}| `{{ field.name }}` | [`{{ field.type }}`]({{ field.href }}) | {{ field.description }}{% if field.defaultValue %} Default: `{{ field.defaultValue }}`.{% endif %}{% if field.isDeprecated %} **Deprecated:** {{ field.deprecationReason }}{% endif %}{% if field.arguments.size > 0 %}
**Arguments:**
{% for arg in field.arguments %}- `{{ arg.name }}` ([`{{ arg.type.name }}`]({{ arg.type.href }})): {{ arg.description }}{% if arg.defaultValue %} Default: `{{ arg.defaultValue }}`.{% endif %}
{% endfor %}{% endif %} |
+{% endfor %}
+{% endif %}
+
+{% elsif pageType == 'interfaces' %}
+{% if item.fields.size > 0 %}
+
+### Fields for `{{ item.name }}`
+
+| Name | Type | Description |
+| --- | --- | --- |
+{% for field in item.fields %}| `{{ field.name }}` | [`{{ field.type }}`]({{ field.href }}) | {{ field.description }}{% if field.defaultValue %} Default: `{{ field.defaultValue }}`.{% endif %}{% if field.isDeprecated %} **Deprecated:** {{ field.deprecationReason }}{% endif %}{% if field.arguments.size > 0 %}
**Arguments:**
{% for arg in field.arguments %}- `{{ arg.name }}` ([`{{ arg.type.name }}`]({{ arg.type.href }})): {{ arg.description }}{% if arg.defaultValue %} Default: `{{ arg.defaultValue }}`.{% endif %}
{% endfor %}{% endif %} |
+{% endfor %}
+{% endif %}
+
+{% elsif pageType == 'enums' %}
+{% if item.values.size > 0 %}
+
+### Values for `{{ item.name }}`
+
+{% for value in item.values %}**`{{ value.name }}`**
+
+{{ value.description }}
+
+{% endfor %}
+{% endif %}
+
+{% elsif pageType == 'unions' %}
+{% if item.possibleTypes.size > 0 %}
+
+### Possible types for `{{ item.name }}`
+
+{% for type in item.possibleTypes %}- [`{{ type.name }}`]({{ type.href }})
+{% endfor %}
+{% endif %}
+
+{% elsif pageType == 'inputObjects' %}
+{% if item.inputFields.size > 0 %}
+
+### Input fields for `{{ item.name }}`
+
+| Name | Type | Description |
+| --- | --- | --- |
+{% for field in item.inputFields %}| `{{ field.name }}` | [`{{ field.type }}`]({{ field.href }}) | {{ field.description }}{% if field.defaultValue %} Default: `{{ field.defaultValue }}`.{% endif %}{% if field.isDeprecated %} **Deprecated:** {{ field.deprecationReason }}{% endif %} |
+{% endfor %}
+{% endif %}
+
+{% elsif pageType == 'scalars' %}
+{%- comment -%}Scalars typically just have name and description{%- endcomment -%}
+
+{% endif %}
+
+{% endfor %}
diff --git a/src/article-api/templates/landing-page.template.md b/src/article-api/templates/landing-page.template.md
new file mode 100644
index 000000000000..cf0dac2168d1
--- /dev/null
+++ b/src/article-api/templates/landing-page.template.md
@@ -0,0 +1,25 @@
+# {{ title }}
+
+{% if intro %}
+{{ intro }}
+{% endif %}
+
+{% for section in sections %}
+{% if section.title %}
+## {{ section.title }}
+{% endif %}
+
+{% for group in section.groups %}
+{% if group.title %}
+### {{ group.title }}
+{% endif %}
+
+{% for link in group.links %}
+* [{{ link.title }}]({{ link.href }})
+{% if link.intro %}
+ {{ link.intro }}
+{% endif %}
+{% endfor %}
+
+{% endfor %}
+{% endfor %}
\ No newline at end of file
diff --git a/src/article-api/templates/rest-page.template.md b/src/article-api/templates/rest-page.template.md
new file mode 100644
index 000000000000..50a9a25f02f1
--- /dev/null
+++ b/src/article-api/templates/rest-page.template.md
@@ -0,0 +1,100 @@
+# {{ page.title }}
+
+{{ page.intro }}
+
+{{ manualContent }}
+
+{% for operation in restOperations %}
+## {{ operation.title }}
+
+```
+{{ operation.verb | upcase }} {{ operation.requestPath }}
+```
+
+{{ operation.description }}
+
+{% if operation.hasParameters %}
+### Parameters
+
+{% if operation.showHeaders %}
+#### Headers
+
+{% if operation.needsContentTypeHeader %}
+- **`content-type`** (string, required)
+ Setting to `application/json` is required.
+
+{% endif %}
+- **`accept`** (string)
+ Setting to `application/vnd.github+json` is recommended.
+
+{% endif %}
+
+{% if operation.parameters.size > 0 %}
+#### Path and query parameters
+
+{% for param in operation.parameters %}
+{% rest_parameter param %}
+{% endfor %}
+
+{% endif %}
+
+{% if operation.bodyParameters.size > 0 %}
+#### Body parameters
+
+{% for param in operation.bodyParameters %}
+{% rest_body_parameter param %}
+{% endfor %}
+
+{% endif %}
+{% endif %}
+
+{% if operation.statusCodes.size > 0 %}
+### HTTP response status codes
+
+{% for statusCode in operation.statusCodes %}
+- **{{ statusCode.httpStatusCode }}**{% if statusCode.description %} - {{ statusCode.description }}{% elsif statusCode.httpStatusMessage %} - {{ statusCode.httpStatusMessage }}{% endif %}
+
+{% endfor %}
+{% endif %}
+
+{% if operation.codeExamples.size > 0 %}
+### Code examples
+
+{% for example in operation.codeExamples %}
+{% if example.request.description %}
+#### {{ example.request.description }}
+
+{% endif %}
+**Request:**
+
+```curl
+curl -L \
+ -X {{ operation.verb | upcase }} \
+ {{ example.request.url }} \
+{%- if example.request.acceptHeader %}
+ -H "Accept: {{ example.request.acceptHeader }}" \
+{%- endif %}
+ -H "Authorization: Bearer "{% if apiVersion %} \
+ -H "X-GitHub-Api-Version: {{ apiVersion }}"{% endif -%}
+{%- if example.request.bodyParameters %} \
+ -d '{{ example.request.bodyParameters }}'{% endif %}
+```
+
+**Response schema:**
+
+{% if example.response.schema %}
+```json
+Status: {{ example.response.statusCode }}
+
+{{ example.response.schema }}
+```
+{% else %}
+```
+Status: {{ example.response.statusCode }}
+```
+{% endif %}
+
+{% endfor %}
+{% endif %}
+
+{% endfor %}
diff --git a/src/article-api/templates/secret-scanning-page.template.md b/src/article-api/templates/secret-scanning-page.template.md
new file mode 100644
index 000000000000..a497a9dde462
--- /dev/null
+++ b/src/article-api/templates/secret-scanning-page.template.md
@@ -0,0 +1,7 @@
+# {{ page.title }}
+
+{% if page.intro %}
+{{ page.intro }}
+{% endif %}
+
+{{ content }}
diff --git a/src/article-api/templates/webhooks-page.template.md b/src/article-api/templates/webhooks-page.template.md
new file mode 100644
index 000000000000..dbf51b71d30f
--- /dev/null
+++ b/src/article-api/templates/webhooks-page.template.md
@@ -0,0 +1,52 @@
+# {{ page.title }}
+
+{% if page.intro %}
+{{ page.intro }}
+{% endif %}
+
+{% if manualContent %}
+{{ manualContent }}
+{% endif %}
+
+{% for webhook in webhooks %}
+## {{ webhook.name }}
+
+{% if webhook.summary %}
+{{ webhook.summary }}
+
+{% endif %}
+{% if webhook.availability.size > 0 %}
+### Availability
+
+{% for avail in webhook.availability %}- `{{ avail }}`
+{% endfor %}
+
+{% endif %}
+### Webhook payload object
+
+{% if webhook.actionTypes.size > 1 %}
+**Action type:** {% for actionType in webhook.actionTypes %}`{{ actionType }}`{% unless forloop.last %}, {% endunless %}{% endfor %}
+
+{% endif %}
+{% if webhook.description %}
+{{ webhook.description }}
+
+{% endif %}
+{% if webhook.bodyParameters.size > 0 %}
+#### Webhook payload object parameters
+
+| Name | Type | Description |
+|------|------|-------------|
+{% for param in webhook.bodyParameters %}| `{{ param.name }}` | `{{ param.type }}` | {% if param.isRequired %}**Required.** {% endif %}{{ param.description }} |
+{% endfor %}
+
+{% endif %}
+{% if webhook.payloadExample %}
+### Webhook payload example
+
+```json
+{{ webhook.payloadExample }}
+```
+
+{% endif %}
+{% endfor %}
diff --git a/src/article-api/tests/article-body.ts b/src/article-api/tests/article-body.ts
index dadb514f616f..26eb956da5d0 100644
--- a/src/article-api/tests/article-body.ts
+++ b/src/article-api/tests/article-body.ts
@@ -25,6 +25,15 @@ describe('article body api', () => {
expect(res.headers['content-type']).toContain('text/markdown')
})
+ test('body includes title and intro', async () => {
+ const res = await get(makeURL('/en/get-started/start-your-journey/hello-world'))
+ expect(res.statusCode).toBe(200)
+ // Body should start with the page title as H1
+ expect(res.body).toMatch(/^# Hello World/)
+ // Body should include the intro after the title
+ expect(res.body).toContain('Follow this Hello World exercise to get started with')
+ })
+
test('octicons auto-generate aria-labels', async () => {
const res = await get(makeURL('/en/get-started/start-your-journey/hello-world'))
expect(res.statusCode).toBe(200)
@@ -59,11 +68,14 @@ describe('article body api', () => {
expect(error).toBe("No page found for '/en/never/heard/of'")
})
- test('non-article pages return error', async () => {
- // Index pages are not articles and should not be renderable
- const res = await get(makeURL('/en/get-started'))
- expect(res.statusCode).toBe(403)
- const { error } = JSON.parse(res.body)
- expect(error).toContain("isn't yet available in markdown")
+ // Removed: non-article pages test - landing pages are now supported via transformers
+
+ test('invalid Referer header does not crash', async () => {
+ const res = await get(makeURL('/en/get-started/start-your-journey/hello-world'), {
+ headers: {
+ Referer: 'invalid-url',
+ },
+ })
+ expect(res.statusCode).toBe(200)
})
})
diff --git a/src/article-api/tests/audit-logs-transformer.ts b/src/article-api/tests/audit-logs-transformer.ts
new file mode 100644
index 000000000000..1bf493c5fc46
--- /dev/null
+++ b/src/article-api/tests/audit-logs-transformer.ts
@@ -0,0 +1,95 @@
+import { beforeAll, describe, expect, test } from 'vitest'
+
+import { get } from '@/tests/helpers/e2etest'
+
+const makeURL = (pathname: string): string => {
+ const params = new URLSearchParams({ pathname })
+ return `/api/article/body?${params}`
+}
+
+describe('Audit Logs transformer', () => {
+ beforeAll(() => {
+ if (!process.env.ROOT) {
+ console.warn(
+ 'WARNING: The Audit Logs transformer tests require the ROOT environment variable to be set to the fixture root',
+ )
+ }
+ })
+
+ test('Security log events page renders with markdown structure', async () => {
+ const res = await get(
+ makeURL('/en/authentication/keeping-your-account-and-data-secure/security-log-events'),
+ )
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for the main heading
+ expect(res.body).toContain('# Security log events')
+
+ // Check for intro
+ expect(res.body).toContain(
+ 'Learn about security log events recorded for your personal account.',
+ )
+
+ // Check for manual content section heading
+ expect(res.body).toContain('## About security log events')
+
+ // Check for new main heading
+ expect(res.body).toContain('## Audit log events')
+
+ // Check for category heading
+ // The template renders "### Category"
+ expect(res.body).toMatch(/### \w+/)
+ })
+
+ test('Enterprise audit log events page renders with markdown structure', async () => {
+ const res = await get(
+ makeURL(
+ '/en/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise',
+ ),
+ )
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ expect(res.body).toContain('# Audit log events for your enterprise')
+ })
+
+ test('Organization audit log events page renders with markdown structure', async () => {
+ const res = await get(
+ makeURL(
+ '/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization',
+ ),
+ )
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ expect(res.body).toContain('# Audit log events for your organization')
+ })
+
+ test('Events are formatted correctly', async () => {
+ const res = await get(
+ makeURL('/en/authentication/keeping-your-account-and-data-secure/security-log-events'),
+ )
+ expect(res.statusCode).toBe(200)
+
+ // Check for event action header
+ // #### `action.name`
+ expect(res.body).toMatch(/#### `[\w.]+`/)
+
+ // Check for fields section
+ expect(res.body).toContain('**Fields:**')
+
+ // Check for reference section
+ expect(res.body).toContain('**Reference:**')
+ })
+
+ test('Manual content is preserved', async () => {
+ const res = await get(
+ makeURL('/en/authentication/keeping-your-account-and-data-secure/security-log-events'),
+ )
+ expect(res.statusCode).toBe(200)
+
+ // The source file has manual content before the marker
+ expect(res.body).toContain('## About security log events')
+ })
+})
diff --git a/src/article-api/tests/bespoke-landing-transformer.ts b/src/article-api/tests/bespoke-landing-transformer.ts
new file mode 100644
index 000000000000..0e6828ea5c0a
--- /dev/null
+++ b/src/article-api/tests/bespoke-landing-transformer.ts
@@ -0,0 +1,33 @@
+import { describe, expect, test } from 'vitest'
+
+import { get } from '@/tests/helpers/e2etest'
+
+const makeURL = (pathname: string): string =>
+ `/api/article/body?${new URLSearchParams({ pathname })}`
+
+describe('bespoke landing transformer', () => {
+ test('renders a bespoke landing page with all sections', async () => {
+ // /en/get-started/article-grid-bespoke is a bespoke landing page
+ const res = await get(makeURL('/en/get-started/article-grid-bespoke'))
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for title
+ expect(res.body).toContain('# Article Grid Bespoke Landing')
+
+ // Should have intro
+ expect(res.body).toContain('A test page for testing')
+ })
+
+ test('renders all descendant articles recursively', async () => {
+ const res = await get(makeURL('/en/get-started/article-grid-bespoke'))
+ expect(res.statusCode).toBe(200)
+
+ // Should have Articles section with all descendant articles (recursive)
+ expect(res.body).toContain('## Articles')
+ expect(res.body).toContain('[Grid Article One]')
+ expect(res.body).toContain('[Grid Article Two]')
+ expect(res.body).toContain('[Grid Article Three]')
+ expect(res.body).toContain('[Grid Article Four]')
+ })
+})
diff --git a/src/article-api/tests/category-landing-transformer.ts b/src/article-api/tests/category-landing-transformer.ts
new file mode 100644
index 000000000000..f29c0c91110b
--- /dev/null
+++ b/src/article-api/tests/category-landing-transformer.ts
@@ -0,0 +1,18 @@
+import { describe, expect, test } from 'vitest'
+
+import { get } from '@/tests/helpers/e2etest'
+
+const makeURL = (pathname: string): string =>
+ `/api/article/body?${new URLSearchParams({ pathname })}`
+
+describe('category landing transformer', () => {
+ test('handles subcategory pages without category-landing layout', async () => {
+ // /en/get-started/start-your-journey is a subcategory index page without category-landing layout
+ // It should return 403 (not transformed) or be handled by default behavior
+ const res = await get(makeURL('/en/get-started/start-your-journey'))
+
+ // This page doesn't have category-landing layout, so it won't be transformed
+ // That's expected behavior - only pages with layout: category-landing are transformed
+ expect([200, 403]).toContain(res.statusCode)
+ })
+})
diff --git a/src/article-api/tests/codeql-cli-transformer.ts b/src/article-api/tests/codeql-cli-transformer.ts
new file mode 100644
index 000000000000..2f82ae5279c1
--- /dev/null
+++ b/src/article-api/tests/codeql-cli-transformer.ts
@@ -0,0 +1,48 @@
+import { describe, expect, test, beforeAll } from 'vitest'
+import { get } from '@/tests/helpers/e2etest'
+
+const makeURL = (pathname: string): string =>
+ `/api/article/body?${new URLSearchParams({ pathname })}`
+
+describe('codeql cli article body api', () => {
+ beforeAll(() => {
+ if (!process.env.ROOT) {
+ console.warn(
+ 'WARNING: The CodeQL CLI transformer tests require the ROOT environment variable to be set to the fixture root',
+ )
+ }
+ })
+
+ test('database-analyze page', async () => {
+ const res = await get(
+ makeURL('/en/code-security/codeql-cli/codeql-cli-manual/database-analyze'),
+ )
+
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for title injection
+ expect(res.body).toContain('# database analyze')
+
+ // Check for intro injection
+ expect(res.body).toContain(
+ 'Analyze a database, producing meaningful results in the context of the source code.',
+ )
+
+ // Check for content
+ expect(res.body).toContain('## Synopsis')
+ expect(res.body).toContain('## Description')
+ expect(res.body).toContain('## Options')
+
+ // Verify HTML comments are stripped
+ expect(res.body).not.toContain('')
+ expect(res.body).not.toContain('')
+ expect(res.body).not.toContain('')
+ })
+
+ test('canTransform returns false for non-codeql-cli pages', async () => {
+ const res = await get(makeURL('/en/get-started/start-your-journey/hello-world'))
+ // This should not be transformed by CodeQL CLI transformer
+ expect(res.statusCode).toBe(200)
+ })
+})
diff --git a/src/article-api/tests/discovery-landing-transformer.ts b/src/article-api/tests/discovery-landing-transformer.ts
new file mode 100644
index 000000000000..a48bd6e10667
--- /dev/null
+++ b/src/article-api/tests/discovery-landing-transformer.ts
@@ -0,0 +1,54 @@
+import { describe, expect, test } from 'vitest'
+
+import { get } from '@/tests/helpers/e2etest'
+
+const makeURL = (pathname: string): string =>
+ `/api/article/body?${new URLSearchParams({ pathname })}`
+
+describe('discovery landing transformer', () => {
+ test('renders a discovery landing page in markdown', async () => {
+ // /en/get-started/carousel is a discovery landing page with recommended carousel
+ const res = await get(makeURL('/en/get-started/carousel'))
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for title and intro
+ expect(res.body).toContain('# Landing Page Carousel')
+ expect(res.body).toContain('A test category page for testing the LandingCarousel component')
+
+ // Should have Articles section with all descendant articles
+ expect(res.body).toContain('## Articles')
+ expect(res.body).toContain('[Carousel Article One]')
+ expect(res.body).toContain('[Carousel Article Two]')
+ expect(res.body).toContain('[Carousel Article Three]')
+ })
+
+ test('renders a discovery landing page with children', async () => {
+ // /en/get-started/article-grid-discovery has discovery landing with children
+ const res = await get(makeURL('/en/get-started/article-grid-discovery'))
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for title
+ expect(res.body).toContain('# Article Grid Discovery')
+
+ // Should have Articles section with all descendant articles (recursive)
+ expect(res.body).toContain('## Articles')
+ expect(res.body).toContain('[Grid Article One]')
+ expect(res.body).toContain('[Grid Article Two]')
+ expect(res.body).toContain('[Grid Article Three]')
+ expect(res.body).toContain('[Grid Article Four]')
+ })
+
+ test('handles discovery landing structure consistently', async () => {
+ // Discovery pages should have a consistent structure
+ const res = await get(makeURL('/en/get-started/carousel'))
+ expect(res.statusCode).toBe(200)
+
+ // Should have intro
+ expect(res.body).toMatch(/^# .+\n\n.+\n\n/)
+
+ // Should have at least one section
+ expect(res.body).toContain('##')
+ })
+})
diff --git a/src/article-api/tests/get-link-data.ts b/src/article-api/tests/get-link-data.ts
new file mode 100644
index 000000000000..fc11254faba3
--- /dev/null
+++ b/src/article-api/tests/get-link-data.ts
@@ -0,0 +1,136 @@
+import { describe, expect, test, vi } from 'vitest'
+import { getLinkData } from '@/article-api/lib/get-link-data'
+import type { Context, Page, Permalink } from '@/types'
+
+// Helper to create a minimal mock page
+function createMockPage(options: {
+ title?: string
+ intro?: string
+ permalinks?: Partial[]
+}): Page {
+ const page = {
+ title: options.title || 'Test Title',
+ intro: options.intro,
+ permalinks: (options.permalinks || []) as Permalink[],
+ renderTitle: vi.fn().mockResolvedValue(options.title || 'Test Title'),
+ renderProp: vi.fn().mockResolvedValue(options.intro || ''),
+ }
+ return page as unknown as Page
+}
+
+// Helper to create a minimal context
+function createContext(currentVersion = 'free-pro-team@latest'): Context {
+ return { currentVersion } as unknown as Context
+}
+
+describe('getLinkData', () => {
+ describe('when page is not found', () => {
+ test('returns href as both href and title when page not resolved', async () => {
+ const resolvePath = vi.fn().mockReturnValue(undefined)
+ const context = createContext()
+
+ const result = await getLinkData(
+ '/en/missing-page',
+ 'en',
+ '/en/current',
+ context,
+ resolvePath,
+ )
+
+ expect(result).toEqual({
+ href: '/en/missing-page',
+ title: '/en/missing-page',
+ })
+ })
+ })
+
+ describe('when page is found', () => {
+ test('returns rendered title from page', async () => {
+ const page = createMockPage({ title: 'My Page Title' })
+ const resolvePath = vi.fn().mockReturnValue(page)
+ const context = createContext()
+
+ const result = await getLinkData('/en/some-page', 'en', '/en/current', context, resolvePath)
+
+ expect(result.title).toBe('My Page Title')
+ expect(page.renderTitle).toHaveBeenCalledWith(context, { unwrap: true })
+ })
+
+ test('returns rendered intro when page has intro', async () => {
+ const page = createMockPage({
+ title: 'Page',
+ intro: 'This is the intro text',
+ })
+ const resolvePath = vi.fn().mockReturnValue(page)
+ const context = createContext()
+
+ const result = await getLinkData('/en/some-page', 'en', '/en/current', context, resolvePath)
+
+ expect(result.intro).toBe('This is the intro text')
+ expect(page.renderProp).toHaveBeenCalledWith('intro', context, { textOnly: true })
+ })
+
+ test('returns empty intro when page has no intro', async () => {
+ const page = createMockPage({ title: 'Page', intro: undefined })
+ const resolvePath = vi.fn().mockReturnValue(page)
+ const context = createContext()
+
+ const result = await getLinkData('/en/some-page', 'en', '/en/current', context, resolvePath)
+
+ expect(result.intro).toBe('')
+ expect(page.renderProp).not.toHaveBeenCalled()
+ })
+
+ test('uses permalink href when matching permalink found', async () => {
+ const page = createMockPage({
+ title: 'Page',
+ permalinks: [
+ { languageCode: 'en', pageVersion: 'free-pro-team@latest', href: '/en/resolved-path' },
+ ],
+ })
+ const resolvePath = vi.fn().mockReturnValue(page)
+ const context = createContext('free-pro-team@latest')
+
+ const result = await getLinkData(
+ '/en/original-href',
+ 'en',
+ '/en/current',
+ context,
+ resolvePath,
+ )
+
+ expect(result.href).toBe('/en/resolved-path')
+ })
+
+ test('falls back to original href when no matching permalink', async () => {
+ const page = createMockPage({
+ title: 'Page',
+ permalinks: [{ languageCode: 'ja', pageVersion: 'free-pro-team@latest', href: '/ja/page' }],
+ })
+ const resolvePath = vi.fn().mockReturnValue(page)
+ const context = createContext('free-pro-team@latest')
+
+ const result = await getLinkData(
+ '/en/original-href',
+ 'en',
+ '/en/current',
+ context,
+ resolvePath,
+ )
+
+ expect(result.href).toBe('/en/original-href')
+ })
+ })
+
+ describe('resolvePath function usage', () => {
+ test('passes correct arguments to resolvePath', async () => {
+ const page = createMockPage({ title: 'Page' })
+ const resolvePath = vi.fn().mockReturnValue(page)
+ const context = createContext()
+
+ await getLinkData('/en/target', 'en', '/en/current', context, resolvePath)
+
+ expect(resolvePath).toHaveBeenCalledWith('/en/target', 'en', '/en/current', context)
+ })
+ })
+})
diff --git a/src/article-api/tests/github-apps-transformer.ts b/src/article-api/tests/github-apps-transformer.ts
new file mode 100644
index 000000000000..9a926d3d44c2
--- /dev/null
+++ b/src/article-api/tests/github-apps-transformer.ts
@@ -0,0 +1,260 @@
+import { beforeAll, describe, expect, test } from 'vitest'
+
+import { get } from '@/tests/helpers/e2etest'
+
+const makeURL = (pathname: string, apiVersion?: string): string => {
+ const params = new URLSearchParams({ pathname })
+ if (apiVersion) {
+ params.set('apiVersion', apiVersion)
+ }
+ return `/api/article/body?${params}`
+}
+
+describe('GitHub Apps transformer', () => {
+ beforeAll(() => {
+ if (!process.env.ROOT) {
+ console.warn(
+ 'WARNING: The GitHub Apps transformer tests require the ROOT environment variable to be set to the fixture root',
+ )
+ }
+ })
+
+ describe('Endpoints pages (list format)', () => {
+ test('server-to-server-rest page renders with markdown structure', async () => {
+ const res = await get(
+ makeURL(
+ '/en/rest/authentication/endpoints-available-for-github-app-installation-access-tokens',
+ ),
+ )
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for the main heading
+ expect(res.body).toContain('# Endpoints available for GitHub App installation access tokens')
+
+ // Should have category headings as h2
+ expect(res.body).toMatch(/^## /m)
+
+ // Should not contain HTML comments
+ expect(res.body).not.toMatch(//)
+ })
+
+ test('user-to-server-rest page renders with markdown structure', async () => {
+ const res = await get(
+ makeURL('/en/rest/authentication/endpoints-available-for-github-app-user-access-tokens'),
+ )
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for the main heading
+ expect(res.body).toContain('# Endpoints available for GitHub App user access tokens')
+
+ // Should have category headings as h2
+ expect(res.body).toMatch(/^## /m)
+ })
+
+ test('fine-grained-pat page renders with markdown structure', async () => {
+ const res = await get(
+ makeURL(
+ '/en/rest/authentication/endpoints-available-for-fine-grained-personal-access-tokens',
+ ),
+ )
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for the main heading
+ expect(res.body).toContain('# Endpoints available for fine-grained personal access tokens')
+
+ // Should have category headings as h2
+ expect(res.body).toMatch(/^## /m)
+ })
+
+ test('endpoints are formatted as bullet lists', async () => {
+ const DEBUG = process.env.RUNNER_DEBUG === '1' || process.env.DEBUG === '1'
+ const url = makeURL(
+ '/en/rest/authentication/endpoints-available-for-github-app-installation-access-tokens',
+ )
+ const startTime = DEBUG ? Date.now() : 0
+ if (DEBUG) console.log(`[DEBUG] Test sending request to ${url}`)
+ const res = await get(url)
+ if (DEBUG)
+ console.log(`[DEBUG] Test response: ${res.statusCode} in ${Date.now() - startTime}ms`)
+ expect(res.statusCode).toBe(200)
+
+ // Check for bullet list items with asterisks (per content guidelines)
+ expect(res.body).toContain('*')
+ expect(res.body).toMatch(/\* \[`[A-Z]+ \//)
+ })
+
+ test('endpoints have correct HTTP verbs', async () => {
+ const res = await get(
+ makeURL(
+ '/en/rest/authentication/endpoints-available-for-github-app-installation-access-tokens',
+ ),
+ )
+ expect(res.statusCode).toBe(200)
+
+ // Check for common HTTP verbs
+ expect(res.body).toMatch(/`GET \//)
+ // May also have POST, PUT, PATCH, DELETE depending on data
+ })
+
+ test('endpoints link to REST API documentation', async () => {
+ const res = await get(
+ makeURL(
+ '/en/rest/authentication/endpoints-available-for-github-app-installation-access-tokens',
+ ),
+ )
+ expect(res.statusCode).toBe(200)
+
+ // Links should point to /en/rest/ paths with anchors
+ expect(res.body).toMatch(/\(\/en\/rest\/[^)]+#[^)]+\)/)
+ })
+ })
+
+ describe('Permissions pages (table format)', () => {
+ test('server-to-server-permissions page renders with markdown structure', async () => {
+ const res = await get(makeURL('/en/rest/authentication/permissions-required-for-github-apps'))
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for the main heading
+ expect(res.body).toContain('# Permissions required for GitHub Apps')
+
+ // Should have permission group headings as h2
+ expect(res.body).toMatch(/^## /m)
+ })
+
+ test('fine-grained-pat-permissions page renders with markdown structure', async () => {
+ const res = await get(
+ makeURL(
+ '/en/rest/authentication/permissions-required-for-fine-grained-personal-access-tokens',
+ ),
+ )
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for the main heading
+ expect(res.body).toContain('# Permissions required for fine-grained personal access tokens')
+
+ // Should have permission group headings as h2
+ expect(res.body).toMatch(/^## /m)
+ })
+
+ test('permissions are formatted as markdown tables', async () => {
+ const res = await get(makeURL('/en/rest/authentication/permissions-required-for-github-apps'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for table structure
+ expect(res.body).toContain('| Endpoint | Access | Tokens | Additional Permissions |')
+ expect(res.body).toContain('|----------|--------|--------|------------------------|')
+ })
+
+ test('table includes access levels', async () => {
+ const res = await get(makeURL('/en/rest/authentication/permissions-required-for-github-apps'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for access levels in table cells
+ expect(res.body).toMatch(/\| read \|/)
+ expect(res.body).toMatch(/\| write \|/)
+ // May also have admin depending on data
+ })
+
+ test('table includes token types (IAT/UAT)', async () => {
+ const res = await get(makeURL('/en/rest/authentication/permissions-required-for-github-apps'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for IAT and UAT links in Tokens column
+ expect(res.body).toMatch(/\[IAT\]\(\/en\/apps\/creating-github-apps\//)
+ expect(res.body).toMatch(/\[UAT\]\(\/en\/apps\/creating-github-apps\//)
+ })
+
+ test('table shows additional permissions with checkmark/cross', async () => {
+ const res = await get(makeURL('/en/rest/authentication/permissions-required-for-github-apps'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for checkmark (ā) or cross (ā) symbols in Additional Permissions column
+ expect(res.body).toMatch(/\| [āā] \|/)
+ })
+
+ test('permissions are grouped by permission name', async () => {
+ const res = await get(makeURL('/en/rest/authentication/permissions-required-for-github-apps'))
+ expect(res.statusCode).toBe(200)
+
+ // Should have multiple permission group headings
+ const headings = res.body.match(/^## .* permissions for .*/gm)
+ expect(headings).toBeTruthy()
+ if (headings) {
+ expect(headings.length).toBeGreaterThan(1)
+ }
+ })
+ })
+
+ describe('Common functionality', () => {
+ test('manual content is included', async () => {
+ const res = await get(makeURL('/en/rest/authentication/permissions-required-for-github-apps'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for manual content that should be in the markdown
+ expect(res.body).toContain('GitHub Apps are created with a set of permissions')
+ })
+
+ test('intro is rendered', async () => {
+ const res = await get(makeURL('/en/rest/authentication/permissions-required-for-github-apps'))
+ expect(res.statusCode).toBe(200)
+
+ // The intro should be present (check frontmatter intro)
+ expect(res.body).toMatch(/For each permission granted/)
+ })
+
+ test('Liquid tags are rendered in content', async () => {
+ const res = await get(makeURL('/en/rest/authentication/permissions-required-for-github-apps'))
+ expect(res.statusCode).toBe(200)
+
+ // Liquid tags should be rendered (fixture might use simplified names)
+ expect(res.body).not.toContain('{% data variables.product.prodname_github_app %}')
+ })
+
+ test('AUTOTITLE links are resolved', async () => {
+ const res = await get(makeURL('/en/rest/authentication/permissions-required-for-github-apps'))
+ expect(res.statusCode).toBe(200)
+
+ // Check that AUTOTITLE has been resolved
+ expect(res.body).not.toContain('[AUTOTITLE]')
+ // Should have actual link text
+ expect(res.body).toMatch(/\[.*?\]\(\/en\/apps\//)
+ })
+
+ test('API version parameter is supported', async () => {
+ const res = await get(
+ makeURL('/en/rest/authentication/permissions-required-for-github-apps', '2022-11-28'),
+ )
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+ })
+
+ test('Invalid apiVersion returns 400 error', async () => {
+ const res = await get(
+ makeURL('/en/rest/authentication/permissions-required-for-github-apps', 'invalid-version'),
+ )
+
+ expect(res.statusCode).toBe(400)
+ const parsed = JSON.parse(res.body)
+ expect(parsed.error).toContain("Invalid apiVersion 'invalid-version'")
+ })
+
+ test('Missing apiVersion defaults to latest', async () => {
+ const res = await get(makeURL('/en/rest/authentication/permissions-required-for-github-apps'))
+ expect(res.statusCode).toBe(200)
+ // Should work without explicit apiVersion
+ })
+
+ test('Non-GitHub Apps pages are not transformed', async () => {
+ const res = await get(makeURL('/en/get-started/start-your-journey/hello-world'))
+ expect(res.statusCode).toBe(200)
+
+ // Regular article pages should still work, they just won't use the GitHub Apps transformer
+ expect(res.body).toContain('## Introduction')
+ })
+ })
+})
diff --git a/src/article-api/tests/graphql-transformer.ts b/src/article-api/tests/graphql-transformer.ts
new file mode 100644
index 000000000000..8b2dda536253
--- /dev/null
+++ b/src/article-api/tests/graphql-transformer.ts
@@ -0,0 +1,370 @@
+import { beforeAll, describe, expect, test } from 'vitest'
+
+import { get } from '@/tests/helpers/e2etest'
+
+const makeURL = (pathname: string): string => {
+ const params = new URLSearchParams({ pathname })
+ return `/api/article/body?${params}`
+}
+
+describe('GraphQL transformer', { timeout: 10000 }, () => {
+ // Cache expensive responses to avoid duplicate requests
+ const responseCache = new Map>>()
+
+ const getCached = async (url: string) => {
+ if (!responseCache.has(url)) {
+ responseCache.set(url, await get(makeURL(url)))
+ }
+ return responseCache.get(url)!
+ }
+
+ beforeAll(() => {
+ if (!process.env.ROOT) {
+ console.warn(
+ 'WARNING: The GraphQL transformer tests require the ROOT environment variable to be set to the fixture root',
+ )
+ }
+ })
+
+ describe('Reference pages', () => {
+ test('queries page renders with markdown structure', async () => {
+ const res = await getCached('/en/graphql/reference/queries')
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for the main heading
+ expect(res.body).toContain('# Queries')
+
+ // Check for intro
+ expect(res.body).toContain(
+ 'The query type defines GraphQL operations that retrieve data from the server.',
+ )
+
+ // Check for manual content section
+ expect(res.body).toContain('## About queries')
+ expect(res.body).toContain('Every GraphQL schema has a root type')
+ })
+
+ test('queries are formatted correctly', async () => {
+ const res = await getCached('/en/graphql/reference/queries')
+ expect(res.statusCode).toBe(200)
+
+ // Check for query heading
+ expect(res.body).toContain('## repository')
+
+ // Check for query description
+ expect(res.body).toContain('Lookup a given repository by the owner and repository name.')
+
+ // Check for type link
+ expect(res.body).toContain('**Type:** [Repository](/en/graphql/reference/objects#repository)')
+ })
+
+ test('query arguments are listed in table format', async () => {
+ const res = await getCached('/en/graphql/reference/queries')
+ expect(res.statusCode).toBe(200)
+
+ // Check for arguments table for codeOfConduct query
+ expect(res.body).toContain('### Arguments for `codeOfConduct`')
+ expect(res.body).toMatch(/\|\s*Name\s*\|\s*Type\s*\|\s*Description\s*\|/)
+ expect(res.body).toMatch(/\|\s*-+\s*\|\s*-+\s*\|\s*-+\s*\|/)
+
+ // Check for specific arguments
+ expect(res.body).toMatch(/\|\s*`key`\s*\|/)
+ expect(res.body).toContain('[`String!`](/en/graphql/reference/scalars#string)')
+ expect(res.body).toContain("The code of conduct's key.")
+ })
+
+ test('mutations page renders correctly', async () => {
+ const res = await getCached('/en/graphql/reference/mutations')
+ expect(res.statusCode).toBe(200)
+
+ // Check for mutation heading
+ expect(res.body).toContain('## createRepository')
+
+ // Check for mutation description
+ expect(res.body).toContain('Create a new repository.')
+
+ // Check for input fields table
+ expect(res.body).toContain('### Input fields for `createRepository`')
+ expect(res.body).toContain('| `input` |')
+
+ // Check for return fields table
+ expect(res.body).toContain('### Return fields for `createRepository`')
+ expect(res.body).toMatch(/\|\s*`repository`\s*\|/)
+ expect(res.body).toContain('The new repository.')
+ })
+
+ test('objects page renders with implements and fields', async () => {
+ const res = await getCached('/en/graphql/reference/objects')
+ expect(res.statusCode).toBe(200)
+
+ // Check for object heading - AddedToMergeQueueEvent has implements
+ expect(res.body).toContain('## AddedToMergeQueueEvent')
+
+ // Check for implements section
+ expect(res.body).toContain('### Implements')
+ expect(res.body).toMatch(/[*-]\s*\[`Node`\]\(\/.*graphql\/reference\/interfaces#node\)/)
+
+ // Check for fields table
+ expect(res.body).toContain('### Fields for `AddedToMergeQueueEvent`')
+ expect(res.body).toMatch(/\|\s*`id`\s*\|/)
+ expect(res.body).toMatch(/\|\s*`actor`\s*\|/)
+ expect(res.body).toMatch(/\|\s*`createdAt`\s*\|/)
+ })
+
+ test('objects page shows field arguments inline', async () => {
+ const res = await getCached('/en/graphql/reference/objects')
+ expect(res.statusCode).toBe(200)
+
+ // Check for User object with repositories field that has arguments
+ expect(res.body).toContain('## User')
+ expect(res.body).toContain('| `repositories` |')
+
+ // Check for inline arguments formatting
+ expect(res.body).toContain('**Arguments:**')
+ expect(res.body).toContain('- `first`')
+ expect(res.body).toContain('Returns the first n elements from the list.')
+ expect(res.body).toContain('- `orderBy`')
+ })
+
+ test('interfaces page renders correctly', async () => {
+ const res = await getCached('/en/graphql/reference/interfaces')
+ expect(res.statusCode).toBe(200)
+
+ // Check for interface heading
+ expect(res.body).toContain('## Node')
+
+ // Check for interface description
+ expect(res.body).toContain('An object with an ID.')
+
+ // Check for fields table
+ expect(res.body).toContain('### Fields for `Node`')
+ expect(res.body).toContain('| `id` |')
+ expect(res.body).toContain('ID of the object.')
+ })
+
+ test('enums page renders with values', async () => {
+ const res = await getCached('/en/graphql/reference/enums')
+ expect(res.statusCode).toBe(200)
+
+ // Check for enum heading
+ expect(res.body).toContain('## RepositoryVisibility')
+
+ // Check for enum description
+ expect(res.body).toContain("The repository's visibility level.")
+
+ // Check for values section
+ expect(res.body).toContain('### Values for `RepositoryVisibility`')
+ expect(res.body).toContain('**`PUBLIC`**')
+ expect(res.body).toContain('The repository is visible to everyone.')
+ expect(res.body).toContain('**`PRIVATE`**')
+ expect(res.body).toContain('The repository is visible only to those with explicit access.')
+ expect(res.body).toContain('**`INTERNAL`**')
+ })
+
+ test('unions page renders with possible types', async () => {
+ const res = await getCached('/en/graphql/reference/unions')
+ expect(res.statusCode).toBe(200)
+
+ // Check for union heading
+ expect(res.body).toContain('## SearchResultItem')
+
+ // Check for union description
+ expect(res.body).toContain('The results of a search.')
+
+ // Check for possible types
+ expect(res.body).toContain('### Possible types for `SearchResultItem`')
+ expect(res.body).toMatch(/[*-]\s*\[`Bot`\]\(\/.*graphql\/reference\/objects#bot\)/)
+ expect(res.body).toMatch(
+ /[*-]\s*\[`PullRequest`\]\(\/.*graphql\/reference\/objects#pullrequest\)/,
+ )
+ expect(res.body).toMatch(/[*-]\s*\[`User`\]\(\/.*graphql\/reference\/objects#user\)/)
+ })
+
+ test('input-objects page renders correctly', async () => {
+ const res = await getCached('/en/graphql/reference/input-objects')
+ expect(res.statusCode).toBe(200)
+
+ // Check for input object heading
+ expect(res.body).toContain('## AbortQueuedMigrationsInput')
+
+ // Check for input object description
+ expect(res.body).toContain('Autogenerated input type of CreateRepository.')
+
+ // Check for input fields table
+ expect(res.body).toContain('### Input fields for `AbortQueuedMigrationsInput`')
+ expect(res.body).toMatch(/\|\s*`ownerId`\s*\|/)
+ expect(res.body).toContain('The ID of the organization that is running the migrations.')
+ })
+
+ test('scalars page renders correctly', async () => {
+ const res = await getCached('/en/graphql/reference/scalars')
+ expect(res.statusCode).toBe(200)
+
+ // Check for scalar heading
+ expect(res.body).toContain('## Boolean')
+
+ // Check for scalar description
+ expect(res.body).toContain('Represents true or false values.')
+
+ // Check for other scalars
+ expect(res.body).toContain('## String')
+ expect(res.body).toContain('## ID')
+ expect(res.body).toContain('## Int')
+ })
+
+ test('reference index page renders', async () => {
+ const res = await getCached('/en/graphql/reference')
+ expect(res.statusCode).toBe(200)
+
+ // Check for main heading
+ expect(res.body).toContain('# Reference')
+
+ // Check for intro with liquid variable rendered
+ expect(res.body).toMatch(/(GitHub|HubGit) GraphQL API schema/)
+ })
+ })
+
+ describe('Overview pages', () => {
+ test('changelog page renders with changes', async () => {
+ const res = await getCached('/en/graphql/overview/changelog')
+ expect(res.statusCode).toBe(200)
+
+ // Check for main heading
+ expect(res.body).toContain('# Changelog')
+
+ // Check for intro
+ expect(res.body).toContain(
+ 'The GraphQL schema changelog is a list of recent and upcoming changes',
+ )
+
+ // Check for manual content
+ expect(res.body).toContain(
+ 'Breaking changes include changes that will break existing queries',
+ )
+
+ // Check for date-based changelog sections
+ expect(res.body).toContain('## Schema changes for 2025-11-30')
+
+ // Check for change items
+ expect(res.body).toContain('### The GraphQL schema includes these changes:')
+ expect(res.body).toContain('Type SuggestedReviewerActor was added')
+ })
+
+ test('changelog removes HTML tags from changes', async () => {
+ const res = await getCached('/en/graphql/overview/changelog')
+ expect(res.statusCode).toBe(200)
+
+ // Check that HTML tags are removed
+ expect(res.body).toContain('Field suggestedReviewerActors was added')
+ expect(res.body).not.toContain('')
+ expect(res.body).not.toContain('')
+ expect(res.body).not.toContain('')
+ expect(res.body).not.toContain('
')
+ })
+
+ test('breaking changes page renders with scheduled changes', async () => {
+ const res = await getCached('/en/graphql/overview/breaking-changes')
+ expect(res.statusCode).toBe(200)
+
+ // Check for main heading
+ expect(res.body).toContain('# Breaking changes')
+
+ // Check for intro
+ expect(res.body).toContain('Learn about recent and upcoming breaking changes')
+
+ // Check for manual content
+ expect(res.body).toContain('## About breaking changes')
+ expect(res.body).toContain('Breaking:** Changes that will break existing queries')
+
+ // Check for date-based sections
+ expect(res.body).toContain('## Changes scheduled for 2025-04-01')
+ expect(res.body).toContain('## Changes scheduled for 2026-04-01')
+ })
+
+ test('breaking changes shows criticality levels', async () => {
+ const res = await getCached('/en/graphql/overview/breaking-changes')
+ expect(res.statusCode).toBe(200)
+
+ // Check for breaking criticality
+ expect(res.body).toMatch(/\*\*Breaking\*\*\s+A change will be made to `\w+\.\w+`\./)
+ expect(res.body).toMatch(/\*\*Description:\*\*.*will be removed/)
+ expect(res.body).toMatch(/\*\*Reason:\*\*/)
+ })
+
+ test('breaking changes removes HTML tags', async () => {
+ const res = await getCached('/en/graphql/overview/breaking-changes')
+ expect(res.statusCode).toBe(200)
+ expect(res.body).toContain('scheduled for')
+
+ // Check that HTML tags are removed from descriptions
+ expect(res.body).not.toContain('')
+ expect(res.body).not.toContain('
')
+ expect(res.body).not.toContain('')
+ expect(res.body).not.toContain('')
+ expect(res.body).not.toContain('')
+ expect(res.body).not.toContain('
')
+ })
+ })
+
+ describe('Liquid tags', () => {
+ test('AUTOTITLE links are resolved in manual content', async () => {
+ const res = await getCached('/en/graphql/reference/queries')
+ expect(res.statusCode).toBe(200)
+
+ // Check that AUTOTITLE has been resolved
+ expect(res.body).toMatch(/(Forming calls with GraphQL|Hello World)/)
+ expect(res.body).toContain('(/en/get-started/start-your-journey/hello-world)')
+
+ // Make sure the raw AUTOTITLE tag is not present
+ expect(res.body).not.toContain('[AUTOTITLE]')
+ })
+
+ test('Liquid variables are rendered in intro', async () => {
+ const res = await getCached('/en/graphql/reference')
+ expect(res.statusCode).toBe(200)
+
+ // Liquid variables should be rendered
+ expect(res.body).toMatch(/(GitHub|HubGit) GraphQL API schema/)
+ expect(res.body).not.toContain('{% data variables.product.prodname_dotcom %}')
+ })
+
+ test('Liquid variables are rendered in breaking changes', async () => {
+ const res = await getCached('/en/graphql/overview/breaking-changes')
+ expect(res.statusCode).toBe(200)
+
+ // Check that liquid variables in intro are rendered
+ expect(res.body).toMatch(/(GitHub|HubGit) GraphQL API/)
+ expect(res.body).not.toContain('{% data variables.product.prodname_dotcom %}')
+ })
+ })
+
+ describe('Multiple items', () => {
+ test('multiple queries are all rendered', async () => {
+ const res = await getCached('/en/graphql/reference/queries')
+ expect(res.statusCode).toBe(200)
+
+ // Check for multiple query headings
+ expect(res.body).toContain('## repository')
+ expect(res.body).toContain('## viewer')
+ })
+
+ test('multiple objects are all rendered', async () => {
+ const res = await getCached('/en/graphql/reference/objects')
+ expect(res.statusCode).toBe(200)
+
+ // Check for multiple object headings
+ expect(res.body).toContain('## Repository')
+ expect(res.body).toContain('## User')
+ })
+
+ test('multiple enums are all rendered', async () => {
+ const res = await getCached('/en/graphql/reference/enums')
+ expect(res.statusCode).toBe(200)
+
+ // Check for multiple enum headings
+ expect(res.body).toContain('## RepositoryVisibility')
+ expect(res.body).toContain('## OrderDirection')
+ })
+ })
+})
diff --git a/src/article-api/tests/journey-landing-transformer.ts b/src/article-api/tests/journey-landing-transformer.ts
new file mode 100644
index 000000000000..09e56d9af8fc
--- /dev/null
+++ b/src/article-api/tests/journey-landing-transformer.ts
@@ -0,0 +1,20 @@
+import { describe, expect, test } from 'vitest'
+
+import { get } from '@/tests/helpers/e2etest'
+
+const makeURL = (pathname: string): string =>
+ `/api/article/body?${new URLSearchParams({ pathname })}`
+
+describe('journey landing transformer', () => {
+ test('renders a journey landing page in markdown', async () => {
+ // /en/get-started/test-journey is a journey landing page in the fixtures
+ const res = await get(makeURL('/en/get-started/test-journey'))
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for journey tracks (now under Links section with track title as h3)
+ expect(res.body).toContain('## Links')
+ expect(res.body).toContain('### First Track')
+ expect(res.body).toContain('* [Hello World](/en/get-started/start-your-journey/hello-world)')
+ })
+})
diff --git a/src/article-api/tests/load-template.ts b/src/article-api/tests/load-template.ts
new file mode 100644
index 000000000000..ade3d72fadf6
--- /dev/null
+++ b/src/article-api/tests/load-template.ts
@@ -0,0 +1,20 @@
+import { describe, expect, test } from 'vitest'
+import { loadTemplate } from '@/article-api/lib/load-template'
+
+describe('loadTemplate', () => {
+ test('loads an existing template file', () => {
+ const content = loadTemplate('landing-page.template.md')
+ expect(content).toContain('# {{ title }}')
+ expect(content).toContain('{% for section in sections %}')
+ })
+
+ test('throws error for non-existent template', () => {
+ expect(() => loadTemplate('non-existent-template.md')).toThrow()
+ })
+
+ test('returns template content as string', () => {
+ const content = loadTemplate('landing-page.template.md')
+ expect(typeof content).toBe('string')
+ expect(content.length).toBeGreaterThan(0)
+ })
+})
diff --git a/src/article-api/tests/product-guides-transformer.ts b/src/article-api/tests/product-guides-transformer.ts
new file mode 100644
index 000000000000..d469e9547942
--- /dev/null
+++ b/src/article-api/tests/product-guides-transformer.ts
@@ -0,0 +1,37 @@
+import { describe, expect, test } from 'vitest'
+
+import { get } from '@/tests/helpers/e2etest'
+
+const makeURL = (pathname: string): string =>
+ `/api/article/body?${new URLSearchParams({ pathname })}`
+
+describe('product guides transformer', () => {
+ test('renders a product guides page with learning tracks', async () => {
+ // Product guides pages use layout: product-guides
+ // /en/codespaces/guides is a product guides page
+ const res = await get(makeURL('/en/codespaces/guides'))
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Should have Links section
+ expect(res.body).toContain('## Links')
+ })
+
+ test('includes guide cards if present', async () => {
+ const res = await get(makeURL('/en/codespaces/guides'))
+ expect(res.statusCode).toBe(200)
+
+ // If includeGuides are present, they should appear under Guides
+ // The rendering depends on what's in the frontmatter
+ expect(res.body).toMatch(/##|###/)
+ })
+
+ test('includes learning tracks if present', async () => {
+ const res = await get(makeURL('/en/codespaces/guides'))
+ expect(res.statusCode).toBe(200)
+
+ // Learning tracks should be rendered as sections with their titles
+ // The actual content depends on frontmatter configuration
+ expect(res.body).toContain('## Links')
+ })
+})
diff --git a/src/article-api/tests/product-landing-transformer.ts b/src/article-api/tests/product-landing-transformer.ts
new file mode 100644
index 000000000000..93349c8807e3
--- /dev/null
+++ b/src/article-api/tests/product-landing-transformer.ts
@@ -0,0 +1,42 @@
+import { describe, expect, test } from 'vitest'
+
+import { get } from '@/tests/helpers/e2etest'
+
+const makeURL = (pathname: string): string =>
+ `/api/article/body?${new URLSearchParams({ pathname })}`
+
+describe('product landing transformer', () => {
+ test('renders a product landing page with basic structure', async () => {
+ // /en/actions is a product landing page in fixtures
+ const res = await get(makeURL('/en/actions'))
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for title
+ expect(res.body).toContain('# GitHub Actions Documentation')
+
+ // Should have intro
+ expect(res.body).toContain('Automate away with')
+ })
+
+ test('renders child categories under Links section', async () => {
+ const res = await get(makeURL('/en/actions'))
+ expect(res.statusCode).toBe(200)
+
+ // All children should be listed under Links section
+ expect(res.body).toContain('## Links')
+
+ // Should contain child categories from fixtures (uses full title, not shortTitle)
+ expect(res.body).toContain('[Category page of GitHub Actions](/en/actions/category)')
+ expect(res.body).toContain('[Using workflows](/en/actions/using-workflows)')
+ })
+
+ test('includes child intros', async () => {
+ const res = await get(makeURL('/en/actions'))
+ expect(res.statusCode).toBe(200)
+
+ // Each child should have its intro
+ expect(res.body).toContain('Learn how to migrate your existing CI/CD workflows')
+ expect(res.body).toContain('Learn how to use workflows')
+ })
+})
diff --git a/src/article-api/tests/resolve-path.ts b/src/article-api/tests/resolve-path.ts
new file mode 100644
index 000000000000..6156b8c1e689
--- /dev/null
+++ b/src/article-api/tests/resolve-path.ts
@@ -0,0 +1,123 @@
+import { describe, expect, test } from 'vitest'
+import { resolvePath } from '@/article-api/lib/resolve-path'
+import type { Context, Page } from '@/types'
+
+// Helper to create a minimal mock page
+function createMockPage(relativePath: string): Page {
+ return {
+ relativePath,
+ permalinks: [],
+ } as unknown as Page
+}
+
+// Helper to create a minimal context with pages
+function createContext(pages: Record): Context {
+ return { pages } as unknown as Context
+}
+
+describe('resolvePath', () => {
+ describe('external URLs', () => {
+ test('returns undefined for http URLs', () => {
+ const context = createContext({})
+ const result = resolvePath('http://example.com', 'en', '/en/copilot', context)
+ expect(result).toBeUndefined()
+ })
+
+ test('returns undefined for https URLs', () => {
+ const context = createContext({})
+ const result = resolvePath('https://example.com/path', 'en', '/en/copilot', context)
+ expect(result).toBeUndefined()
+ })
+ })
+
+ describe('missing context.pages', () => {
+ test('returns undefined when context.pages is undefined', () => {
+ const context = {} as Context
+ const result = resolvePath('/en/copilot', 'en', '/en', context)
+ expect(result).toBeUndefined()
+ })
+ })
+
+ describe('language-prefixed absolute paths', () => {
+ test('finds page with exact language-prefixed path', () => {
+ const page = createMockPage('copilot/quickstart.md')
+ const context = createContext({
+ '/en/copilot/quickstart': page,
+ })
+ const result = resolvePath('/en/copilot/quickstart', 'en', '/en/copilot', context)
+ expect(result).toBe(page)
+ })
+
+ test('handles trailing slash in href', () => {
+ const page = createMockPage('copilot/quickstart.md')
+ const context = createContext({
+ '/en/copilot/quickstart': page,
+ })
+ const result = resolvePath('/en/copilot/quickstart/', 'en', '/en/copilot', context)
+ expect(result).toBe(page)
+ })
+ })
+
+ describe('paths with leading slash (relative to pathname)', () => {
+ test('resolves path relative to current pathname', () => {
+ const page = createMockPage('copilot/get-started.md')
+ const context = createContext({
+ '/en/copilot/get-started': page,
+ })
+ const result = resolvePath('/get-started', 'en', '/en/copilot', context)
+ expect(result).toBe(page)
+ })
+
+ test('handles nested paths relative to pathname', () => {
+ const page = createMockPage('copilot/tutorials/basics.md')
+ const context = createContext({
+ '/en/copilot/tutorials/basics': page,
+ })
+ const result = resolvePath('/tutorials/basics', 'en', '/en/copilot', context)
+ expect(result).toBe(page)
+ })
+ })
+
+ describe('relative paths without leading slash', () => {
+ test('resolves relative path by joining with pathname', () => {
+ const page = createMockPage('copilot/quickstart.md')
+ const context = createContext({
+ '/en/copilot/quickstart': page,
+ })
+ const result = resolvePath('quickstart', 'en', '/en/copilot', context)
+ expect(result).toBe(page)
+ })
+ })
+
+ describe('versioned keys (endsWith matching)', () => {
+ test('finds versioned page using endsWith strategy', () => {
+ const page = createMockPage('copilot/index.md')
+ // The key ends with the path portion after the version string
+ const context = createContext({
+ '/en/enterprise-cloud@latest/copilot': page,
+ })
+ // When looking for /copilot, strategy 4 will find keys ending with /copilot
+ const result = resolvePath('/copilot', 'en', '/en', context)
+ expect(result).toBe(page)
+ })
+
+ test('finds page when key has trailing slash', () => {
+ const page = createMockPage('copilot/index.md')
+ const context = createContext({
+ '/en/copilot/': page,
+ })
+ const result = resolvePath('/en/copilot', 'en', '/en', context)
+ expect(result).toBe(page)
+ })
+ })
+
+ describe('not found cases', () => {
+ test('returns undefined when page does not exist', () => {
+ const context = createContext({
+ '/en/other': createMockPage('other.md'),
+ })
+ const result = resolvePath('/en/copilot', 'en', '/en', context)
+ expect(result).toBeUndefined()
+ })
+ })
+})
diff --git a/src/article-api/tests/rest-transformer.ts b/src/article-api/tests/rest-transformer.ts
new file mode 100644
index 000000000000..3cd8e6d5ad85
--- /dev/null
+++ b/src/article-api/tests/rest-transformer.ts
@@ -0,0 +1,315 @@
+import { beforeAll, describe, expect, test } from 'vitest'
+
+import { get } from '@/tests/helpers/e2etest'
+
+const makeURL = (pathname: string, apiVersion?: string): string => {
+ const params = new URLSearchParams({ pathname })
+ if (apiVersion) {
+ params.set('apiVersion', apiVersion)
+ }
+ return `/api/article/body?${params}`
+}
+
+describe('REST transformer', () => {
+ beforeAll(() => {
+ if (!process.env.ROOT) {
+ console.warn(
+ 'WARNING: The REST transformer tests require the ROOT environment variable to be set to the fixture root',
+ )
+ }
+ })
+
+ test('REST page renders with markdown structure', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for the main heading
+ expect(res.body).toContain('# GitHub Actions Artifacts')
+
+ // Check for intro (using fixture's prodname_actions which is 'HubGit Actions')
+ expect(res.body).toContain('Use the REST API to interact with artifacts in HubGit Actions.')
+
+ // Check for manual content section heading
+ expect(res.body).toContain('## About artifacts in HubGit Actions')
+ })
+
+ test('REST operations are formatted correctly', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for operation heading
+ expect(res.body).toContain('## List artifacts for a repository')
+
+ // Check for HTTP method and endpoint
+ expect(res.body).toContain('GET /repos/{owner}/{repo}/actions/artifacts')
+
+ // Check for operation description
+ expect(res.body).toContain('Lists all artifacts for a repository.')
+ })
+
+ test('Parameters section includes headers', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for parameters heading
+ expect(res.body).toContain('### Parameters')
+
+ // Check for headers section
+ expect(res.body).toContain('#### Headers')
+
+ // Check for accept header
+ expect(res.body).toContain('**`accept`** (string)')
+ expect(res.body).toContain('Setting to `application/vnd.github+json` is recommended.')
+ })
+
+ test('Path and query parameters are listed', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for path and query parameters section
+ expect(res.body).toContain('#### Path and query parameters')
+
+ // Check for specific parameters
+ expect(res.body).toContain('**`owner`** (string) (required)')
+ expect(res.body).toContain('The account owner of the repository.')
+
+ expect(res.body).toContain('**`repo`** (string) (required)')
+
+ expect(res.body).toContain('**`per_page`** (integer)')
+ expect(res.body).toContain('Default: `30`')
+ })
+
+ test('Status codes are formatted correctly', async () => {
+ const DEBUG = process.env.RUNNER_DEBUG === '1' || process.env.DEBUG === '1'
+ const url = makeURL('/en/rest/actions/artifacts')
+ const startTime = DEBUG ? Date.now() : 0
+ if (DEBUG) console.log(`[DEBUG] Test sending request to ${url}`)
+ const res = await get(url)
+ if (DEBUG)
+ console.log(`[DEBUG] Test response: ${res.statusCode} in ${Date.now() - startTime}ms`)
+ expect(res.statusCode).toBe(200)
+
+ // Check for status codes section
+ expect(res.body).toContain('### HTTP response status codes')
+
+ // Check for specific status code
+ expect(res.body).toContain('**200**')
+ expect(res.body).toContain('OK')
+ })
+
+ test('Code examples include curl with proper formatting', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for code examples section
+ expect(res.body).toContain('### Code examples')
+
+ // Check for request/response labels
+ expect(res.body).toContain('**Request:**')
+ expect(res.body).toContain('**Response schema:**')
+
+ // Check for curl code block
+ expect(res.body).toContain('```curl')
+ expect(res.body).toContain('curl -L \\')
+ expect(res.body).toContain('-X GET \\')
+ expect(res.body).toContain('https://api.github.com/repos/OWNER/REPO/actions/artifacts \\')
+ expect(res.body).toContain('-H "Accept: application/vnd.github.v3+json" \\')
+ expect(res.body).toContain('-H "Authorization: Bearer "')
+ })
+
+ test('Code examples include X-GitHub-Api-Version header by default', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for API version header in curl example
+ expect(res.body).toContain('-H "X-GitHub-Api-Version: 2022-11-28"')
+ })
+
+ test('Code examples include specified API version', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts', '2022-11-28'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for the specified API version header
+ expect(res.body).toContain('-H "X-GitHub-Api-Version: 2022-11-28"')
+ })
+
+ test('Liquid tags are rendered in intro', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+
+ // Liquid tags should be rendered, not shown as raw tags (fixture uses 'HubGit Actions')
+ expect(res.body).toContain('HubGit Actions')
+ expect(res.body).not.toContain('{% data variables.product.prodname_actions %}')
+
+ // Check in both the intro and the manual content section
+ expect(res.body).toMatch(/Use the REST API to interact with artifacts in HubGit Actions/)
+ expect(res.body).toMatch(/About artifacts in HubGit Actions/)
+ })
+
+ test('AUTOTITLE links are resolved', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+
+ // Check that AUTOTITLE has been resolved to actual link text
+ // The link should have the actual page title, not "AUTOTITLE"
+ expect(res.body).toContain('[Storing workflow data as artifacts]')
+ expect(res.body).toContain('(/en/actions/using-workflows/storing-workflow-data-as-artifacts)')
+
+ // Make sure the raw AUTOTITLE tag is not present
+ expect(res.body).not.toContain('[AUTOTITLE]')
+
+ // Verify the link appears in the manual content section
+ expect(res.body).toMatch(
+ /About artifacts in HubGit Actions[\s\S]*Storing workflow data as artifacts/,
+ )
+ })
+
+ test('Markdown links are preserved in descriptions', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+
+ // Check that markdown links are preserved
+ expect(res.body).toMatch(/\[.*?\]\(\/en\/.*?\)/)
+ })
+
+ test('Response schema is formatted correctly', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for JSON code block with schema label
+ expect(res.body).toContain('**Response schema:**')
+ expect(res.body).toContain('```json')
+ expect(res.body).toContain('Status: 200')
+
+ // Verify schema structure is present (not an example)
+ expect(res.body).toContain('"type":')
+ expect(res.body).toContain('"properties":')
+
+ // Check for common schema keywords
+ const schemaMatch = res.body.match(/```json\s+Status: 200\s+([\s\S]*?)```/)
+ expect(schemaMatch).toBeTruthy()
+
+ if (schemaMatch) {
+ const schemaContent = schemaMatch[1]
+ const schema = JSON.parse(schemaContent)
+
+ // Verify it's a valid OpenAPI/JSON schema structure
+ expect(schema).toHaveProperty('type')
+ expect(schema.type).toBe('object')
+ expect(schema).toHaveProperty('properties')
+
+ // Verify it has expected properties for artifacts response
+ expect(schema.properties).toHaveProperty('total_count')
+ expect(schema.properties).toHaveProperty('artifacts')
+ }
+ })
+
+ test('Non-REST pages return appropriate error', async () => {
+ const res = await get(makeURL('/en/get-started/start-your-journey/hello-world'))
+ expect(res.statusCode).toBe(200)
+
+ // Regular article pages should still work, they just won't use the transformer
+ expect(res.body).toContain('## Introduction')
+ })
+
+ test('Invalid apiVersion returns 400 error', async () => {
+ // An invalid API version should return a validation error with 400 status
+ const res = await get(makeURL('/en/rest/actions/artifacts', 'invalid-version'))
+
+ // Returns 400 because the apiVersion is invalid (client error)
+ expect(res.statusCode).toBe(400)
+ const parsed = JSON.parse(res.body)
+ expect(parsed.error).toContain("Invalid apiVersion 'invalid-version'")
+ expect(parsed.error).toContain('Valid API versions are:')
+ expect(parsed.error).toContain('2022-11-28')
+ })
+
+ test('Multiple apiVersion query parameters returns 400 error', async () => {
+ // Multiple apiVersion parameters should be rejected
+ const res = await get(
+ '/api/article/body?pathname=/en/rest/actions/artifacts&apiVersion=2022-11-28&apiVersion=2023-01-01',
+ )
+
+ expect(res.statusCode).toBe(400)
+ const parsed = JSON.parse(res.body)
+ expect(parsed.error).toBe("Multiple 'apiVersion' keys")
+ })
+
+ test('Valid apiVersion passes validation', async () => {
+ // A valid API version should work
+ const res = await get(makeURL('/en/rest/actions/artifacts', '2022-11-28'))
+
+ expect(res.statusCode).toBe(200)
+ expect(res.body).toContain('-H "X-GitHub-Api-Version: 2022-11-28"')
+ })
+
+ test('Missing apiVersion defaults to latest', async () => {
+ // When no apiVersion is provided, it should default to the latest version
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+
+ expect(res.statusCode).toBe(200)
+ // Should include the default API version header
+ expect(res.body).toContain('-H "X-GitHub-Api-Version: 2022-11-28"')
+ })
+
+ test('Multiple operations on a page are all rendered', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for multiple operation headings
+ expect(res.body).toContain('## List artifacts for a repository')
+ expect(res.body).toContain('## Get an artifact')
+ expect(res.body).toContain('## Delete an artifact')
+ })
+
+ test('Body parameters are formatted correctly for POST/PUT operations', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+
+ // For operations with body parameters, check formatting
+ // (artifacts endpoint is mostly GET/DELETE, but structure should be there)
+ // The transformer handles body parameters when present
+ })
+
+ test('Content-type header is included for operations that need it', async () => {
+ const res = await get(makeURL('/en/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+
+ // Content-type header appears for operations that require it
+ // The REST transformer adds this based on the operation data
+ })
+
+ test('Non-English language paths work correctly', async () => {
+ // Note: This test may fail in dev mode with ENABLED_LANGUAGES=en
+ // but the transformer itself should handle any language path
+ const res = await get(makeURL('/ja/rest/actions/artifacts'))
+ expect(res.statusCode).toBe(200)
+
+ // The transformer should work regardless of language prefix
+ // because it looks for 'rest' in the path and gets the category/subcategory after it
+ // e.g. /ja/rest/actions/artifacts should work the same as /en/rest/actions/artifacts
+
+ // Verify the operation content is present (in English, since REST data is not translated)
+ expect(res.body).toContain('## List artifacts for a repository')
+ expect(res.body).toContain('GET /repos/{owner}/{repo}/actions/artifacts')
+
+ // Check what language is actually being served by examining the response
+ // If Japanese translations are loaded, the title will be in Japanese
+ // Otherwise, it falls back to English
+ const hasJapaneseTitle = res.body.includes('# GitHub Actions ć¢ć¼ćć£ćć”ćÆć')
+ const hasEnglishTitle = res.body.includes('# GitHub Actions Artifacts')
+
+ // One of them must be present
+ expect(hasJapaneseTitle || hasEnglishTitle).toBe(true)
+
+ // Verify the appropriate content based on which language was served
+ if (hasJapaneseTitle) {
+ // If Japanese is loaded, expect Japanese intro text
+ expect(res.body).toContain('ć¢ć¼ćć£ćć”ćÆć')
+ } else {
+ // If Japanese is not loaded, expect English fallback
+ expect(res.body).toContain('Use the REST API to interact with artifacts in HubGit Actions')
+ }
+ })
+})
diff --git a/src/article-api/tests/secret-scanning-transformer.ts b/src/article-api/tests/secret-scanning-transformer.ts
new file mode 100644
index 000000000000..44b1440fb3be
--- /dev/null
+++ b/src/article-api/tests/secret-scanning-transformer.ts
@@ -0,0 +1,53 @@
+import { describe, expect, test } from 'vitest'
+import { get } from '@/tests/helpers/e2etest'
+
+const makeURL = (pathname: string): string =>
+ `/api/article/body?${new URLSearchParams({ pathname })}`
+
+describe('secret scanning article body api', () => {
+ test('supported-secret-scanning-patterns page', async () => {
+ const res = await get(
+ makeURL('/en/code-security/secret-scanning/introduction/supported-secret-scanning-patterns'),
+ )
+
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for expected content
+ expect(res.body).toContain('# Supported secret scanning patterns')
+ expect(res.body).toContain('## Supported secrets')
+
+ // Verify HTML comments are stripped
+ expect(res.body).not.toMatch(//)
+
+ // Verify table content is present with providers
+ expect(res.body).toMatch(/|\s*Provider\s*|/)
+ expect(res.body).toMatch(/\| (Adafruit|AWS|Alibaba|Amazon)/)
+
+ // Verify Copilot secret scanning section is present (feature-flagged for fpt/ghec)
+ // Note: This may not appear if feature flags aren't loaded in the test environment
+ const hasCopilotSection = res.body.match(/###.*Copilot secret scanning/i)
+ const hasGenericPassword = res.body.match(/\|\s*Generic\s*\|\s*password\s*\|/)
+ if (hasCopilotSection) {
+ // If Copilot section is present, verify it has the expected content
+ expect(hasGenericPassword).toBeTruthy()
+ }
+
+ // Verify correct section title (should be "Default patterns" for fpt if feature flags load correctly)
+ // Accept either title since CI may not load feature flags consistently
+ const hasDefaultPatterns = res.body.includes('### Default patterns')
+ const hasHighConfidence = res.body.includes('### High confidence patterns')
+
+ // In fixture mode (CI), the page may have minimal content without these sections
+ // Just verify the main table exists; section headings are optional
+ expect(res.body).toContain('## Supported secrets')
+
+ // If either section is present, verify mutual exclusivity
+ if (hasDefaultPatterns) {
+ expect(hasHighConfidence).toBe(false)
+ }
+ if (hasHighConfidence) {
+ expect(hasDefaultPatterns).toBe(false)
+ }
+ })
+})
diff --git a/src/article-api/tests/strip-html-comments.ts b/src/article-api/tests/strip-html-comments.ts
new file mode 100644
index 000000000000..e4fcba03b38e
--- /dev/null
+++ b/src/article-api/tests/strip-html-comments.ts
@@ -0,0 +1,105 @@
+import { describe, expect, test } from 'vitest'
+import {
+ stripHtmlComments,
+ stripHtmlCommentsAndNormalizeWhitespace,
+} from '@/article-api/lib/strip-html-comments'
+
+describe('stripHtmlComments', () => {
+ test('removes single-line HTML comments', () => {
+ const input = ''
+ const expected = ''
+ expect(stripHtmlComments(input)).toBe(expected)
+ })
+
+ test('removes multiple HTML comments', () => {
+ const input = '\nSome content\n'
+ const expected = 'Some content'
+ expect(stripHtmlComments(input)).toBe(expected)
+ })
+
+ test('removes inline HTML comments', () => {
+ const input = 'Text before text after'
+ const expected = 'Text before text after'
+ expect(stripHtmlComments(input)).toBe(expected)
+ })
+
+ test('preserves content without HTML comments', () => {
+ const input = 'Just regular markdown content'
+ const expected = 'Just regular markdown content'
+ expect(stripHtmlComments(input)).toBe(expected)
+ })
+
+ test('handles multiple comments on same line', () => {
+ const input = ' text '
+ const expected = 'text'
+ expect(stripHtmlComments(input)).toBe(expected)
+ })
+})
+
+describe('stripHtmlCommentsAndNormalizeWhitespace', () => {
+ test('removes HTML comments and normalizes blank lines', () => {
+ const input = `
+
+
+
+Content here`
+ const expected = 'Content here'
+ expect(stripHtmlCommentsAndNormalizeWhitespace(input)).toBe(expected)
+ })
+
+ test('normalizes multiple blank lines to at most two', () => {
+ const input = `Line 1
+
+
+
+Line 2`
+ const expected = `Line 1
+
+Line 2`
+ expect(stripHtmlCommentsAndNormalizeWhitespace(input)).toBe(expected)
+ })
+
+ test('handles real CodeQL CLI content pattern', () => {
+ const input = `# database analyze
+
+Analyze a database, producing meaningful results
+
+
+
+
+
+
+
+## Synopsis
+
+\`\`\`shell
+codeql database analyze
+\`\`\``
+
+ const expected = `# database analyze
+
+Analyze a database, producing meaningful results
+
+## Synopsis
+
+\`\`\`shell
+codeql database analyze
+\`\`\``
+
+ expect(stripHtmlCommentsAndNormalizeWhitespace(input)).toBe(expected)
+ })
+
+ test('preserves intentional double line breaks', () => {
+ const input = `# Title
+
+Paragraph 1
+
+Paragraph 2`
+ const expected = `# Title
+
+Paragraph 1
+
+Paragraph 2`
+ expect(stripHtmlCommentsAndNormalizeWhitespace(input)).toBe(expected)
+ })
+})
diff --git a/src/article-api/tests/toc-transformer.ts b/src/article-api/tests/toc-transformer.ts
new file mode 100644
index 000000000000..4bef199a0879
--- /dev/null
+++ b/src/article-api/tests/toc-transformer.ts
@@ -0,0 +1,55 @@
+import { describe, expect, test } from 'vitest'
+
+import { get } from '@/tests/helpers/e2etest'
+
+const makeURL = (pathname: string): string =>
+ `/api/article/body?${new URLSearchParams({ pathname })}`
+
+describe('toc transformer', () => {
+ test('renders a category page (3-segment URL) with children', async () => {
+ // /en/actions/category is a category page (documentType: category) with children but no layout
+ const res = await get(makeURL('/en/actions/category'))
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for title and intro
+ expect(res.body).toContain('# Category page of GitHub Actions')
+ expect(res.body).toContain('Learn how to migrate your existing CI/CD workflows')
+
+ // Should have Links section with children (uses full title, not shortTitle)
+ expect(res.body).toContain('## Links')
+ expect(res.body).toContain('[Subcategory page about Actions](/en/actions/category/subcategory)')
+ })
+
+ test('renders a subcategory page (4+-segment URL) with children', async () => {
+ // /en/actions/category/subcategory is a subcategory page (documentType: subcategory) with children but no layout
+ const res = await get(makeURL('/en/actions/category/subcategory'))
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Check for title
+ expect(res.body).toContain('# Subcategory page about Actions')
+
+ // Should have Links section with children
+ expect(res.body).toContain('## Links')
+ })
+
+ test('includes child intro text', async () => {
+ const res = await get(makeURL('/en/actions/category'))
+ expect(res.statusCode).toBe(200)
+
+ // Each child link should have its intro text below
+ expect(res.body).toContain("Here's the intro for")
+ })
+
+ test('resolves child page titles correctly', async () => {
+ const res = await get(makeURL('/en/actions/category/subcategory'))
+ expect(res.statusCode).toBe(200)
+
+ // Should NOT have href paths as titles
+ expect(res.body).not.toContain('* [/en/actions/category/subcategory/')
+
+ // Should have proper article titles (or shortTitle)
+ expect(res.body).toMatch(/\[.*\]\(\/en\/actions\/category\/subcategory\/.*\)/)
+ })
+})
diff --git a/src/article-api/tests/webhooks-transformer.ts b/src/article-api/tests/webhooks-transformer.ts
new file mode 100644
index 000000000000..4bf18d7ef21f
--- /dev/null
+++ b/src/article-api/tests/webhooks-transformer.ts
@@ -0,0 +1,140 @@
+import { beforeAll, describe, expect, test } from 'vitest'
+
+import { get } from '@/tests/helpers/e2etest'
+
+function makeURL(pathname: string, queryParams?: Record) {
+ const params = new URLSearchParams(queryParams || {})
+ const queryString = params.toString()
+ return `/api/article/body?pathname=${encodeURIComponent(pathname)}${queryString ? `&${queryString}` : ''}`
+}
+
+describe('Webhooks transformer', () => {
+ beforeAll(() => {
+ if (!process.env.ROOT) {
+ console.warn(
+ 'WARNING: The Webhooks transformer tests require the ROOT environment variable to be set to the fixture root',
+ )
+ }
+ })
+
+ test('webhook-events-and-payloads page renders with markdown structure', async () => {
+ const res = await get(makeURL('/en/webhooks/webhook-events-and-payloads'))
+ expect(res.statusCode).toBe(200)
+ expect(res.headers['content-type']).toContain('text/markdown')
+
+ // Should have title
+ expect(res.body).toContain('# Webhook events and payloads')
+
+ // Should have intro
+ expect(res.body).toContain('Learn about when each webhook event occurs')
+ })
+
+ test('webhooks are formatted as sections with headers', async () => {
+ const res = await get(makeURL('/en/webhooks/webhook-events-and-payloads'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for webhook event headers (## webhook_name)
+ expect(res.body).toMatch(/^## \w+/m)
+ })
+
+ test('webhooks show available actions', async () => {
+ const res = await get(makeURL('/en/webhooks/webhook-events-and-payloads'))
+ expect(res.statusCode).toBe(200)
+
+ // Should list action types for webhooks with multiple actions
+ expect(res.body).toContain('**Action type:**')
+ })
+
+ test('webhooks show availability information', async () => {
+ const res = await get(makeURL('/en/webhooks/webhook-events-and-payloads'))
+ expect(res.statusCode).toBe(200)
+
+ // Should show availability as a heading
+ expect(res.body).toContain('### Availability')
+ })
+
+ test('manual content is included', async () => {
+ const res = await get(makeURL('/en/webhooks/webhook-events-and-payloads'))
+ expect(res.statusCode).toBe(200)
+
+ // Check for some known manual content from the markdown file
+ expect(res.body).toContain('About webhook events and payloads')
+ })
+
+ test('intro is rendered', async () => {
+ const res = await get(makeURL('/en/webhooks/webhook-events-and-payloads'))
+ expect(res.statusCode).toBe(200)
+
+ const introMatch = res.body.match(/^Learn about when each webhook event/m)
+ expect(introMatch).toBeTruthy()
+ })
+
+ test('Liquid tags are rendered in content', async () => {
+ const res = await get(makeURL('/en/webhooks/webhook-events-and-payloads'))
+ expect(res.statusCode).toBe(200)
+
+ // Check that data variables are rendered (not left as Liquid syntax)
+ expect(res.body).not.toContain('{% data')
+ expect(res.body).not.toContain('{{')
+ })
+
+ test('AUTOTITLE links are resolved', async () => {
+ const res = await get(makeURL('/en/webhooks/webhook-events-and-payloads'))
+ expect(res.statusCode).toBe(200)
+
+ // AUTOTITLE should be replaced with actual titles
+ expect(res.body).not.toContain('[AUTOTITLE]')
+ })
+
+ test('webhooks show payload parameters table', async () => {
+ const res = await get(makeURL('/en/webhooks/webhook-events-and-payloads'))
+ expect(res.statusCode).toBe(200)
+
+ // Should show payload object parameters section
+ expect(res.body).toContain('### Webhook payload object')
+ expect(res.body).toContain('#### Webhook payload object parameters')
+ // Should have a markdown table with parameter columns (may have extra spacing from formatting)
+ expect(res.body).toMatch(/\|\s*Name\s*\|\s*Type\s*\|\s*Description\s*\|/)
+ })
+
+ test('webhooks show descriptions', async () => {
+ const res = await get(makeURL('/en/webhooks/webhook-events-and-payloads'))
+ expect(res.statusCode).toBe(200)
+
+ // Should include webhook descriptions (converted from HTML to plain text)
+ // Using actual descriptions from real webhook data
+ expect(res.body).toContain('A check run was completed')
+ })
+
+ test('webhooks show body parameters in table', async () => {
+ const res = await get(makeURL('/en/webhooks/webhook-events-and-payloads'))
+ expect(res.statusCode).toBe(200)
+
+ // Should show parameter names and types in tables
+ expect(res.body).toContain('`action`')
+ expect(res.body).toContain('`string`')
+ expect(res.body).toContain('`object`')
+ // Should mark required parameters
+ expect(res.body).toContain('**Required.**')
+ })
+
+ test('webhooks show payload examples when available', async () => {
+ const res = await get(makeURL('/en/webhooks/webhook-events-and-payloads'))
+ expect(res.statusCode).toBe(200)
+
+ // NOTE: The current webhook source data does not include payloadExample fields,
+ // so this section won't appear in the output. The transformer code (lines 115-120)
+ // is ready to display payload examples if/when they are added to the source data.
+ // For now, we just verify the transformer doesn't crash on missing examples.
+ expect(res.statusCode).toBe(200)
+ })
+
+ test('Non-webhooks pages are not transformed', async () => {
+ const res = await get(makeURL('/en/get-started/start-your-journey/hello-world'))
+ expect(res.statusCode).toBe(200)
+
+ // Regular pages should not be transformed by webhooks transformer
+ // They should have their normal HTML-like structure
+ expect(res.body).toContain('Hello World')
+ })
+})
diff --git a/src/article-api/transformers/audit-logs-transformer.ts b/src/article-api/transformers/audit-logs-transformer.ts
new file mode 100644
index 000000000000..1da904f694d8
--- /dev/null
+++ b/src/article-api/transformers/audit-logs-transformer.ts
@@ -0,0 +1,135 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer } from './types'
+import type { CategorizedEvents } from '@/audit-logs/types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import matter from '@gr2m/gray-matter'
+
+/**
+ * Transformer for Audit Logs pages
+ * Converts audit log events and their data into markdown format using a Liquid template
+ */
+export class AuditLogsTransformer implements PageTransformer {
+ templateName = 'audit-logs-page.template.md'
+
+ canTransform(page: Page): boolean {
+ return page.autogenerated === 'audit-logs'
+ }
+
+ async transform(page: Page, pathname: string, context: Context): Promise {
+ // Import audit log lib dynamically to avoid circular dependencies
+ const { getCategorizedAuditLogEvents, getCategoryNotes, resolveReferenceLinksToMarkdown } =
+ await import('@/audit-logs/lib/index')
+
+ // Extract version from context
+ const currentVersion = context.currentVersion!
+
+ let pageType = ''
+ if (pathname.includes('/security-log-events')) {
+ pageType = 'user'
+ } else if (pathname.includes('/audit-log-events-for-your-enterprise')) {
+ pageType = 'enterprise'
+ } else if (pathname.includes('/audit-log-events-for-your-organization')) {
+ pageType = 'organization'
+ } else {
+ throw new Error(`Unknown audit log page type for path: ${pathname}`)
+ }
+
+ // Get the audit log events data
+ const categorizedEvents = getCategorizedAuditLogEvents(pageType, currentVersion)
+ const categoryNotes = getCategoryNotes()
+
+ // Prepare manual content
+ let manualContent = ''
+ if (page.markdown) {
+ const markerIndex = page.markdown.indexOf(
+ '',
+ )
+ if (markerIndex > 0) {
+ const { content } = matter(page.markdown)
+ const manualContentMarkerIndex = content.indexOf(
+ '',
+ )
+ if (manualContentMarkerIndex > 0) {
+ const rawManualContent = content.substring(0, manualContentMarkerIndex).trim()
+ if (rawManualContent) {
+ manualContent = await renderContent(rawManualContent, {
+ ...context,
+ markdownRequested: true,
+ })
+ }
+ }
+ }
+ }
+
+ // Prepare data for template
+ const templateData = await this.prepareTemplateData(
+ page,
+ categorizedEvents,
+ categoryNotes,
+ context,
+ manualContent,
+ resolveReferenceLinksToMarkdown,
+ )
+
+ // Load and render template
+ const templateContent = loadTemplate(this.templateName)
+
+ // Render the template with Liquid
+ const rendered = await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+
+ return rendered
+ }
+
+ /**
+ * Prepare data for the Liquid template
+ */
+ private async prepareTemplateData(
+ page: Page,
+ categorizedEvents: CategorizedEvents,
+ categoryNotes: Record,
+ context: Context,
+ manualContent: string,
+ resolveReferenceLinksToMarkdown: (docsReferenceLinks: string, context: any) => Promise,
+ ): Promise> {
+ // Prepare page intro
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+
+ // Sort categories and events
+ const sortedCategorizedEvents: CategorizedEvents = {}
+ const sortedCategories = Object.keys(categorizedEvents).sort((a, b) => a.localeCompare(b))
+
+ for (const category of sortedCategories) {
+ // Create a copy of the events array to avoid mutating the cache
+ const events = [...categorizedEvents[category]].sort((a, b) =>
+ a.action.localeCompare(b.action),
+ )
+ sortedCategorizedEvents[category] = await Promise.all(
+ events.map(async (event) => {
+ const newEvent = { ...event }
+ if (newEvent.docs_reference_links && newEvent.docs_reference_links !== 'N/A') {
+ newEvent.docs_reference_links = await resolveReferenceLinksToMarkdown(
+ newEvent.docs_reference_links,
+ context,
+ )
+ }
+ return newEvent
+ }),
+ )
+ }
+
+ return {
+ page: {
+ title: page.title,
+ intro,
+ },
+ manualContent,
+ categorizedEvents: sortedCategorizedEvents,
+ categoryNotes,
+ }
+ }
+}
diff --git a/src/article-api/transformers/bespoke-landing-transformer.ts b/src/article-api/transformers/bespoke-landing-transformer.ts
new file mode 100644
index 000000000000..1dacd240a3f4
--- /dev/null
+++ b/src/article-api/transformers/bespoke-landing-transformer.ts
@@ -0,0 +1,125 @@
+import type { Context, Page, ResolvedArticle } from '@/types'
+import type { PageTransformer, TemplateData, Section, LinkData } from './types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import { getAllTocItems, flattenTocItems } from '@/article-api/lib/get-all-toc-items'
+
+interface BespokeLandingPage extends Omit {
+ featuredLinks?: Record>
+ children?: string[]
+ carousels?: Record
+ rawCarousels?: Record
+ includedCategories?: string[]
+}
+
+/**
+ * Transforms bespoke-landing pages into markdown format.
+ * Handles carousels and full article listings.
+ * Note: Unlike discovery-landing, bespoke-landing shows ALL articles
+ * regardless of includedCategories.
+ */
+export class BespokeLandingTransformer implements PageTransformer {
+ templateName = 'landing-page.template.md'
+
+ canTransform(page: Page): boolean {
+ return page.layout === 'bespoke-landing'
+ }
+
+ async transform(page: Page, pathname: string, context: Context): Promise {
+ const templateData = await this.prepareTemplateData(page, pathname, context)
+
+ const templateContent = loadTemplate(this.templateName)
+
+ const rendered = await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+
+ return rendered
+ }
+
+ private async prepareTemplateData(
+ page: Page,
+ _pathname: string,
+ context: Context,
+ ): Promise {
+ const bespokePage = page as BespokeLandingPage
+ const sections: Section[] = []
+
+ // Process carousels (each carousel becomes a section)
+ const carousels = bespokePage.carousels ?? bespokePage.rawCarousels
+ if (carousels && typeof carousels === 'object') {
+ const { default: getLearningTrackLinkData } = await import(
+ '@/learning-track/lib/get-link-data'
+ )
+
+ for (const [carouselKey, articles] of Object.entries(carousels)) {
+ if (!Array.isArray(articles) || articles.length === 0) continue
+
+ let links: LinkData[]
+ if (typeof articles[0] === 'object' && 'title' in articles[0]) {
+ // Already resolved articles
+ links = articles.map((item) => ({
+ href: typeof item === 'string' ? item : item.href,
+ title: (typeof item === 'object' && item.title) || '',
+ intro: (typeof item === 'object' && item.intro) || '',
+ }))
+ } else {
+ // Raw paths that need resolution
+ const linkData = await getLearningTrackLinkData(articles as string[], context, {
+ title: true,
+ intro: true,
+ })
+ links = (linkData || []).map(
+ (item: { href: string; title?: string; intro?: string }) => ({
+ href: item.href,
+ title: item.title || '',
+ intro: item.intro || '',
+ }),
+ )
+ }
+
+ const validLinks = links.filter((l) => l.href && l.title)
+ if (validLinks.length > 0) {
+ // Use carousel key as title (capitalize first letter)
+ const sectionTitle = carouselKey.charAt(0).toUpperCase() + carouselKey.slice(1)
+ sections.push({
+ title: sectionTitle,
+ groups: [{ title: null, links: validLinks }],
+ })
+ }
+ }
+ }
+
+ // Articles section: recursively gather ALL descendant articles
+ // This matches the behavior of the site which uses genericTocFlat/genericTocNested
+ // Note: For bespoke-landing pages, the site shows ALL articles regardless of includedCategories
+ // (includedCategories only filters for discovery-landing pages)
+ if (bespokePage.children && bespokePage.children.length > 0) {
+ const tocItems = await getAllTocItems(page, context, {
+ recurse: true,
+ renderIntros: true,
+ })
+
+ // Flatten to get all leaf articles (excludeParents: true means only get articles, not category pages)
+ const allArticles = flattenTocItems(tocItems, { excludeParents: true })
+
+ if (allArticles.length > 0) {
+ sections.push({
+ title: 'Articles',
+ groups: [{ title: null, links: allArticles }],
+ })
+ }
+ }
+
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+ const title = await page.renderTitle(context, { unwrap: true })
+
+ return {
+ title,
+ intro,
+ sections,
+ }
+ }
+}
diff --git a/src/article-api/transformers/category-landing-transformer.ts b/src/article-api/transformers/category-landing-transformer.ts
new file mode 100644
index 000000000000..3678372fb36c
--- /dev/null
+++ b/src/article-api/transformers/category-landing-transformer.ts
@@ -0,0 +1,155 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer, TemplateData, Section, LinkData } from './types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import { resolvePath } from '@/article-api/lib/resolve-path'
+import { getLinkData } from '@/article-api/lib/get-link-data'
+
+interface CategoryPage extends Page {
+ spotlight?: Array<{ article: string; image: string }>
+ children?: string[]
+}
+
+/**
+ * Transforms category-landing pages into markdown format.
+ * Handles spotlight sections and recursively collects all descendant articles.
+ */
+export class CategoryLandingTransformer implements PageTransformer {
+ templateName = 'landing-page.template.md'
+
+ canTransform(page: Page): boolean {
+ return page.layout === 'category-landing'
+ }
+
+ async transform(page: Page, pathname: string, context: Context): Promise {
+ const templateData = await this.prepareTemplateData(page, pathname, context)
+ const templateContent = loadTemplate(this.templateName)
+
+ return await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+ }
+
+ /**
+ * Recursively collects all descendant articles from the given parent hrefs.
+ * Traverses the page tree, adding non-index pages and recursing into children.
+ * Uses a visited set to prevent infinite loops from circular references.
+ */
+ private async getAllDescendantArticles(
+ parentHrefs: string[],
+ languageCode: string,
+ pathname: string,
+ context: Context,
+ visited: Set = new Set(),
+ ): Promise {
+ const allArticles: LinkData[] = []
+
+ for (const href of parentHrefs) {
+ // Prevent infinite loops from circular references
+ if (visited.has(href)) continue
+ visited.add(href)
+
+ const parentPage = resolvePath(href, languageCode, pathname, context) as
+ | CategoryPage
+ | undefined
+ if (!parentPage) continue
+
+ // Add this page if it's an article (not an index)
+ if (!parentPage.relativePath.endsWith('index.md')) {
+ const linkData = await getLinkData(href, languageCode, pathname, context, resolvePath)
+ if (linkData.href) {
+ allArticles.push(linkData)
+ }
+ }
+
+ // Recursively get children
+ const children = parentPage.children
+ if (children && Array.isArray(children) && children.length > 0) {
+ // Get the parent's permalink to use as the base path for resolving children
+ const parentPermalink = parentPage.permalinks.find(
+ (p) => p.languageCode === languageCode && p.pageVersion === context.currentVersion,
+ )
+ const parentPathname = parentPermalink ? parentPermalink.href : pathname
+
+ const childArticles = await this.getAllDescendantArticles(
+ children,
+ languageCode,
+ parentPathname,
+ context,
+ visited,
+ )
+ allArticles.push(...childArticles)
+ }
+ }
+
+ return allArticles
+ }
+
+ private async prepareTemplateData(
+ page: Page,
+ pathname: string,
+ context: Context,
+ ): Promise {
+ const categoryPage = page as CategoryPage
+ const languageCode = page.languageCode || 'en'
+ const sections: Section[] = []
+
+ // Spotlight section
+ const spotlight = categoryPage.spotlight
+ if (spotlight && spotlight.length > 0) {
+ const links = await Promise.all(
+ spotlight.map(async (item) => {
+ const linkData = await getLinkData(
+ item.article,
+ languageCode,
+ pathname,
+ context,
+ resolvePath,
+ )
+ return {
+ ...linkData,
+ intro: linkData.intro
+ ? `${linkData.intro} (Image: ${item.image})`
+ : `Image: ${item.image}`,
+ }
+ }),
+ )
+
+ const validLinks = links.filter((l) => l.href)
+ if (validLinks.length > 0) {
+ sections.push({
+ title: 'Spotlight',
+ groups: [{ title: null, links: validLinks }],
+ })
+ }
+ }
+
+ // Children - get all descendant articles recursively
+ if (categoryPage.children) {
+ const allArticles = await this.getAllDescendantArticles(
+ categoryPage.children,
+ languageCode,
+ pathname,
+ context,
+ )
+
+ if (allArticles.length > 0) {
+ sections.push({
+ title: 'Links',
+ groups: [{ title: null, links: allArticles }],
+ })
+ }
+ }
+
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+ const title = await page.renderTitle(context, { unwrap: true })
+
+ return {
+ title,
+ intro,
+ sections,
+ }
+ }
+}
diff --git a/src/article-api/transformers/codeql-cli-transformer.ts b/src/article-api/transformers/codeql-cli-transformer.ts
new file mode 100644
index 000000000000..f32c8fbc903e
--- /dev/null
+++ b/src/article-api/transformers/codeql-cli-transformer.ts
@@ -0,0 +1,49 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer } from './types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import { stripHtmlCommentsAndNormalizeWhitespace } from '@/article-api/lib/strip-html-comments'
+
+/**
+ * Transformer for CodeQL CLI reference pages.
+ * Renders autogenerated CodeQL CLI documentation pages as markdown using a Liquid template.
+ * Sets `markdownRequested` to true in the context to ensure the page is rendered as markdown,
+ * bypassing the default article type check.
+ */
+export class CodeQLCliTransformer implements PageTransformer {
+ templateName = 'codeql-cli-page.template.md'
+
+ canTransform(page: Page): boolean {
+ return page.autogenerated === 'codeql-cli'
+ }
+
+ async transform(page: Page, _pathname: string, context: Context): Promise {
+ // CodeQL CLI pages are fully generated markdown files in the repo.
+ // We render them with markdownRequested=true to get the markdown output.
+ context.markdownRequested = true
+ const content = await page.render(context)
+
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+
+ // Prepare template data
+ const templateData: Record = {
+ page: {
+ title: page.title,
+ intro,
+ },
+ content,
+ }
+
+ // Load and render template
+ const templateContent = loadTemplate(this.templateName)
+
+ const result = await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+
+ // Strip HTML comments (e.g., markdownlint-disable comments) from the output
+ return stripHtmlCommentsAndNormalizeWhitespace(result)
+ }
+}
diff --git a/src/article-api/transformers/discovery-landing-transformer.ts b/src/article-api/transformers/discovery-landing-transformer.ts
new file mode 100644
index 000000000000..e03dea7440e7
--- /dev/null
+++ b/src/article-api/transformers/discovery-landing-transformer.ts
@@ -0,0 +1,215 @@
+import type { Context, Page, ResolvedArticle } from '@/types'
+import type { PageTransformer, TemplateData, Section, LinkData } from './types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import { getAllTocItems, flattenTocItems } from '@/article-api/lib/get-all-toc-items'
+
+interface DiscoveryPage extends Page {
+ rawIntroLinks?: Record
+ introLinks?: Record
+ carousels?: Record
+ rawCarousels?: Record
+ includedCategories?: string[]
+ children?: string[]
+}
+
+/**
+ * Transforms discovery-landing pages into markdown format.
+ * Handles recommended carousel, intro links, article grids with
+ * category filtering, and children listings.
+ */
+export class DiscoveryLandingTransformer implements PageTransformer {
+ templateName = 'landing-page.template.md'
+
+ canTransform(page: Page): boolean {
+ return page.layout === 'discovery-landing'
+ }
+
+ async transform(page: Page, pathname: string, context: Context): Promise {
+ const templateData = await this.prepareTemplateData(page, pathname, context)
+
+ const templateContent = loadTemplate(this.templateName)
+
+ const rendered = await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+
+ return rendered
+ }
+
+ private async prepareTemplateData(
+ page: Page,
+ _pathname: string,
+ context: Context,
+ ): Promise {
+ const discoveryPage = page as DiscoveryPage
+ const sections: Section[] = []
+
+ // Process carousels (each carousel becomes a section)
+ const carousels = discoveryPage.carousels ?? discoveryPage.rawCarousels
+ if (carousels && typeof carousels === 'object') {
+ const { default: getLearningTrackLinkData } = await import(
+ '@/learning-track/lib/get-link-data'
+ )
+
+ for (const [carouselKey, articles] of Object.entries(carousels)) {
+ if (!Array.isArray(articles) || articles.length === 0) continue
+
+ let links: LinkData[]
+ if (typeof articles[0] === 'object' && 'title' in articles[0]) {
+ // Already resolved articles
+ links = articles.map((item) => ({
+ href: typeof item === 'string' ? item : item.href,
+ title: (typeof item === 'object' && item.title) || '',
+ intro: (typeof item === 'object' && item.intro) || '',
+ }))
+ } else {
+ // Raw paths that need resolution
+ const linkData = await getLearningTrackLinkData(articles as string[], context, {
+ title: true,
+ intro: true,
+ })
+ links = (linkData || []).map(
+ (item: { href: string; title?: string; intro?: string }) => ({
+ href: item.href,
+ title: item.title || '',
+ intro: item.intro || '',
+ }),
+ )
+ }
+
+ const validLinks = links.filter((l) => l.href && l.title)
+ if (validLinks.length > 0) {
+ // Use carousel key as title (capitalize first letter)
+ const sectionTitle = carouselKey.charAt(0).toUpperCase() + carouselKey.slice(1)
+ sections.push({
+ title: sectionTitle,
+ groups: [{ title: null, links: validLinks }],
+ })
+ }
+ }
+ }
+
+ // Intro links (getting started)
+ const rawIntroLinks = discoveryPage.introLinks ?? discoveryPage.rawIntroLinks
+ if (rawIntroLinks) {
+ const { default: getLearningTrackLinkData } = await import(
+ '@/learning-track/lib/get-link-data'
+ )
+ const links = await Promise.all(
+ Object.values(rawIntroLinks).map(async (href): Promise => {
+ if (typeof href === 'string') {
+ const linkData = await getLearningTrackLinkData(href, context)
+ if (Array.isArray(linkData) && linkData.length > 0) {
+ const item = linkData[0]
+ return { href: item.href || '', title: item.title || '', intro: item.intro || '' }
+ } else if (
+ linkData &&
+ typeof linkData === 'object' &&
+ !Array.isArray(linkData) &&
+ 'href' in linkData
+ ) {
+ const item = linkData as { href?: string; title?: string; intro?: string }
+ return {
+ href: item.href || '',
+ title: item.title || '',
+ intro: item.intro || '',
+ }
+ }
+ }
+ return { href: '', title: '' }
+ }),
+ )
+ const validLinks = links.filter((l) => l.href)
+ if (validLinks.length > 0) {
+ sections.push({
+ title: 'Links',
+ groups: [{ title: 'Getting started', links: validLinks }],
+ })
+ }
+ }
+
+ // Articles section: recursively gather ALL descendant articles
+ // This matches the behavior of the site which uses genericTocFlat/genericTocNested
+ if (discoveryPage.children && discoveryPage.children.length > 0) {
+ const tocItems = await getAllTocItems(page, context, {
+ recurse: true,
+ renderIntros: true,
+ })
+
+ // Flatten to get all leaf articles (excludeParents: true means only get articles, not category pages)
+ let allArticles = flattenTocItems(tocItems, { excludeParents: true })
+
+ // Apply includedCategories filter if specified
+ if (discoveryPage.includedCategories && discoveryPage.includedCategories.length > 0) {
+ const includedCategories = discoveryPage.includedCategories.map((c) => c.toLowerCase())
+ // Filter tocItems before flattening to preserve category info
+ const filterByCategory = (items: typeof tocItems): typeof tocItems => {
+ return items.filter((item) => {
+ const itemCategories = (item.category || []).map((c: string) => c.toLowerCase())
+ return itemCategories.some((cat) => includedCategories.includes(cat))
+ })
+ }
+
+ // Re-flatten with category filtering
+ const filteredTocItems = filterByCategory(flattenTocItemsWithCategory(tocItems))
+ allArticles = filteredTocItems.map((item) => ({
+ href: item.href,
+ title: item.title,
+ intro: item.intro,
+ }))
+ }
+
+ if (allArticles.length > 0) {
+ sections.push({
+ title: 'Articles',
+ groups: [{ title: null, links: allArticles }],
+ })
+ }
+ }
+
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+ const title = await page.renderTitle(context, { unwrap: true })
+
+ return {
+ title,
+ intro,
+ sections,
+ }
+ }
+}
+
+/**
+ * Helper to flatten TOC items while preserving category info for filtering
+ */
+interface TocItemWithCategory {
+ href: string
+ title: string
+ intro?: string
+ category?: string[]
+ childTocItems?: TocItemWithCategory[]
+}
+
+function flattenTocItemsWithCategory(tocItems: TocItemWithCategory[]): TocItemWithCategory[] {
+ const result: TocItemWithCategory[] = []
+
+ function recurse(items: TocItemWithCategory[]) {
+ for (const item of items) {
+ const hasChildren = item.childTocItems && item.childTocItems.length > 0
+
+ // Only include leaf nodes (articles, not category pages)
+ if (!hasChildren) {
+ result.push(item)
+ }
+
+ if (hasChildren) {
+ recurse(item.childTocItems!)
+ }
+ }
+ }
+
+ recurse(tocItems)
+ return result
+}
diff --git a/src/article-api/transformers/github-apps-transformer.ts b/src/article-api/transformers/github-apps-transformer.ts
new file mode 100644
index 000000000000..f04b9b1e3c94
--- /dev/null
+++ b/src/article-api/transformers/github-apps-transformer.ts
@@ -0,0 +1,341 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer } from './types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import matter from '@gr2m/gray-matter'
+
+const DEBUG = process.env.RUNNER_DEBUG === '1' || process.env.DEBUG === '1'
+
+// GitHub Apps data types
+interface GitHubAppsOperation {
+ slug: string
+ subcategory?: string
+ verb: string
+ requestPath: string
+}
+
+interface GitHubAppsPermissionOperation {
+ category: string
+ slug: string
+ subcategory: string
+ verb: string
+ requestPath: string
+ access: 'admin' | 'write' | 'read'
+ 'user-to-server': boolean
+ 'server-to-server': boolean
+ 'additional-permissions': boolean
+}
+
+interface GitHubAppsPermissionGroup {
+ displayTitle: string
+ permissions: GitHubAppsPermissionOperation[]
+}
+
+type GitHubAppsListData = Record
+type GitHubAppsPermissionsData = Record
+
+interface PreparedOperation {
+ slug: string
+ verb: string
+ requestPath: string
+ category: string
+}
+
+interface PreparedPermissionOperation extends PreparedOperation {
+ access: string
+ userToServer: boolean
+ serverToServer: boolean
+ additionalPermissions: boolean
+}
+
+interface PreparedListItem {
+ category: string
+ operations: PreparedOperation[]
+}
+
+interface PreparedPermissionItem {
+ permissionName: string
+ displayTitle: string
+ permissions: PreparedPermissionOperation[]
+}
+
+// Map content files to their page types from config.json
+const PAGE_TYPE_MAP: Record = {
+ 'endpoints-available-for-github-app-installation-access-tokens.md': 'server-to-server-rest',
+ 'endpoints-available-for-github-app-user-access-tokens.md': 'user-to-server-rest',
+ 'permissions-required-for-github-apps.md': 'server-to-server-permissions',
+ 'endpoints-available-for-fine-grained-personal-access-tokens.md': 'fine-grained-pat',
+ 'permissions-required-for-fine-grained-personal-access-tokens.md': 'fine-grained-pat-permissions',
+}
+
+// Page types that display as bullet lists vs tables
+const LIST_PAGE_TYPES = new Set([
+ 'server-to-server-rest',
+ 'user-to-server-rest',
+ 'fine-grained-pat',
+])
+
+const PERMISSIONS_PAGE_TYPES = new Set([
+ 'server-to-server-permissions',
+ 'fine-grained-pat-permissions',
+])
+
+/**
+ * Transformer for GitHub Apps pages.
+ * Converts GitHub Apps autogenerated data into markdown format.
+ * Uses a Liquid template for list pages, but builds markdown tables programmatically
+ * in TypeScript for permissions pages to avoid Liquid escaping issues.
+ */
+export class GithubAppsTransformer implements PageTransformer {
+ templateName = 'github-apps-page.template.md'
+
+ canTransform(page: Page): boolean {
+ return page.autogenerated === 'github-apps'
+ }
+
+ async transform(
+ page: Page,
+ pathname: string,
+ context: Context,
+ apiVersion?: string,
+ ): Promise {
+ const startTime = DEBUG ? Date.now() : 0
+ if (DEBUG) console.log(`[DEBUG] GitHubAppsTransformer: ${pathname}`)
+
+ // Import getAppsData dynamically to avoid circular dependencies
+ const { getAppsData } = await import('@/github-apps/lib/index')
+
+ // Extract version from context
+ const currentVersion = context.currentVersion!
+
+ // Use the provided apiVersion, or fall back to the latest from context
+ const effectiveApiVersion =
+ apiVersion ||
+ (context.currentVersionObj?.apiVersions?.length
+ ? context.currentVersionObj.latestApiVersion
+ : undefined)
+
+ // Determine page type from the page's relative path
+ const filename = page.relativePath.split('/').pop()
+ const pageType = filename ? PAGE_TYPE_MAP[filename] : undefined
+
+ if (!pageType) {
+ throw new Error(`Unknown GitHub Apps page type for path: ${page.relativePath}`)
+ }
+
+ // Get the GitHub Apps data
+ const appsData = await getAppsData(pageType, currentVersion, effectiveApiVersion)
+
+ // Prepare manual content
+ let manualContent = ''
+ if (page.markdown) {
+ const { content } = matter(page.markdown)
+ // GitHub Apps pages don't have the automated marker, so we render all markdown content
+ if (content.trim()) {
+ manualContent = await renderContent(content, {
+ ...context,
+ markdownRequested: true,
+ })
+
+ // Strip HTML comments and normalize whitespace
+ manualContent = manualContent
+ .replace(//gs, '')
+ .replace(/\n{3,}/g, '\n\n')
+ .trim()
+ }
+ }
+
+ // Prepare data for template based on page type
+ const isListPage = LIST_PAGE_TYPES.has(pageType)
+ const isPermissionsPage = PERMISSIONS_PAGE_TYPES.has(pageType)
+
+ const templateData = await this.prepareTemplateData(
+ page,
+ appsData,
+ context,
+ manualContent,
+ isListPage,
+ isPermissionsPage,
+ )
+
+ // Load template
+ const templateContent = loadTemplate(this.templateName)
+
+ // For permissions pages, we need to construct the tables manually to avoid Liquid escaping
+ let finalContent: string
+ if (isPermissionsPage) {
+ // Build the intro manually
+ let introMarkdown = `# ${templateData.page.title}\n\n`
+ if (templateData.page.intro) {
+ introMarkdown += `${templateData.page.intro}\n\n`
+ }
+ if (templateData.manualContent) {
+ introMarkdown += `${templateData.manualContent}\n\n`
+ }
+
+ // Build the tables manually
+ let tablesMarkdown = ''
+ for (const item of templateData.items as PreparedPermissionItem[]) {
+ tablesMarkdown += `## ${item.displayTitle}\n\n`
+ tablesMarkdown += '| Endpoint | Access | Tokens | Additional Permissions |\n'
+ tablesMarkdown += '|----------|--------|--------|------------------------|\n'
+
+ for (const perm of item.permissions) {
+ const lang = context.currentLanguage || 'en'
+ const version =
+ context.currentVersion === 'free-pro-team@latest' ? '' : `${context.currentVersion}/`
+ const endpoint = `[\`${perm.verb} ${perm.requestPath}\`](/${lang}/${version}rest/${perm.category}#${perm.slug})`
+
+ let tokens = ''
+ if (perm.userToServer) {
+ tokens += `[UAT](/${lang}/${version}apps/creating-github-apps/authenticating-with-a-github-app/authenticating-with-a-github-app-on-behalf-of-a-user)`
+ }
+ if (perm.userToServer && perm.serverToServer) {
+ tokens += '
'
+ }
+ if (perm.serverToServer) {
+ tokens += `[IAT](/${lang}/${version}apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app-installation)`
+ }
+
+ const additionalPerms = perm.additionalPermissions ? 'ā' : 'ā'
+
+ tablesMarkdown += `| ${endpoint} | ${perm.access} | ${tokens} | ${additionalPerms} |\n`
+ }
+ tablesMarkdown += '\n'
+ }
+
+ finalContent = introMarkdown + tablesMarkdown
+ } else {
+ // For list pages, Liquid template works fine
+ finalContent = await renderContent(templateContent, {
+ ...context,
+ pageData: templateData.page,
+ manualContent: templateData.manualContent,
+ isListPage: templateData.isListPage,
+ items: templateData.items,
+ markdownRequested: true,
+ })
+ }
+
+ if (DEBUG)
+ console.log(
+ `[DEBUG] GitHubAppsTransformer.transform completed in ${Date.now() - startTime}ms`,
+ )
+ return finalContent
+ }
+
+ /**
+ * Prepare data for the Liquid template
+ */
+ private async prepareTemplateData(
+ page: Page,
+ appsData: GitHubAppsListData | GitHubAppsPermissionsData,
+ context: Context,
+ manualContent: string,
+ isListPage: boolean,
+ isPermissionsPage: boolean,
+ ): Promise<{
+ page: { title: string; intro: string }
+ manualContent: string
+ isListPage: boolean
+ isPermissionsPage: boolean
+ items: PreparedListItem[] | PreparedPermissionItem[]
+ }> {
+ // Prepare page intro
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+
+ // Get categories without subcategories from rest lib
+ const { categoriesWithoutSubcategories } = await import('@/rest/lib/index')
+
+ // Prepare items based on page type
+ let preparedItems: PreparedListItem[] | PreparedPermissionItem[] = []
+
+ if (isListPage) {
+ // For list pages, data is organized by category -> array of operations
+ preparedItems = Object.entries(appsData as GitHubAppsListData).map(
+ ([category, operations]) => ({
+ category,
+ operations: operations.map((op) =>
+ this.prepareOperation(op, category, categoriesWithoutSubcategories),
+ ),
+ }),
+ )
+ } else if (isPermissionsPage) {
+ // For permissions pages, data is organized by permission name -> permission object
+ preparedItems = Object.entries(appsData as GitHubAppsPermissionsData).map(
+ ([permissionName, permissionObject]) => {
+ const { displayTitle, permissions } = permissionObject
+ // Sort by access level (admin, write, read)
+ const adminPermissions = permissions.filter((p) => p.access === 'admin')
+ const writePermissions = permissions.filter((p) => p.access === 'write')
+ const readPermissions = permissions.filter((p) => p.access === 'read')
+ const sortedPermissions = [...adminPermissions, ...writePermissions, ...readPermissions]
+
+ return {
+ permissionName,
+ displayTitle,
+ permissions: sortedPermissions.map((op) =>
+ this.preparePermissionOperation(op, categoriesWithoutSubcategories),
+ ),
+ }
+ },
+ )
+ }
+
+ return {
+ page: {
+ title: page.title,
+ intro,
+ },
+ manualContent,
+ isListPage,
+ isPermissionsPage,
+ items: preparedItems,
+ }
+ }
+
+ /**
+ * Prepare a single operation for list-based rendering (endpoints)
+ */
+ private prepareOperation(
+ operation: GitHubAppsOperation,
+ category: string,
+ categoriesWithoutSubcategories: string[],
+ ): PreparedOperation {
+ const fullCategory = operation.subcategory
+ ? categoriesWithoutSubcategories.includes(category)
+ ? category
+ : `${category}/${operation.subcategory}`
+ : category
+
+ return {
+ slug: operation.slug,
+ verb: operation.verb.toUpperCase(),
+ requestPath: operation.requestPath,
+ category: fullCategory,
+ }
+ }
+
+ /**
+ * Prepare a single operation for permissions-based rendering (tables)
+ */
+ private preparePermissionOperation(
+ operation: GitHubAppsPermissionOperation,
+ categoriesWithoutSubcategories: string[],
+ ): PreparedPermissionOperation {
+ const category = categoriesWithoutSubcategories.includes(operation.category)
+ ? operation.category
+ : `${operation.category}/${operation.subcategory}`
+
+ return {
+ slug: operation.slug,
+ verb: operation.verb.toUpperCase(),
+ requestPath: operation.requestPath,
+ access: operation.access,
+ category,
+ userToServer: operation['user-to-server'] || false,
+ serverToServer: operation['server-to-server'] || false,
+ additionalPermissions: operation['additional-permissions'] || false,
+ }
+ }
+}
diff --git a/src/article-api/transformers/graphql-breaking-changes-transformer.ts b/src/article-api/transformers/graphql-breaking-changes-transformer.ts
new file mode 100644
index 000000000000..e0268c7351c5
--- /dev/null
+++ b/src/article-api/transformers/graphql-breaking-changes-transformer.ts
@@ -0,0 +1,69 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer } from './types'
+import type { BreakingChangesT } from '@/graphql/components/types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import { fastTextOnly } from '@/content-render/unified/text-only'
+import { extractManualContent } from '@/article-api/lib/graphql-helpers'
+import GithubSlugger from 'github-slugger'
+
+/**
+ * Transformer for GraphQL breaking changes page
+ * Renders breaking changes organized by date
+ */
+export class GraphQLBreakingChangesTransformer implements PageTransformer {
+ templateName = 'graphql-breaking-changes.template.md'
+
+ canTransform(page: Page): boolean {
+ if (page.autogenerated !== 'graphql') return false
+
+ return page.relativePath.includes('graphql/overview/breaking-changes')
+ }
+
+ async transform(page: Page, _pathname: string, context: Context): Promise {
+ const currentVersion = context.currentVersion!
+
+ const { getGraphqlBreakingChanges } = await import('@/graphql/lib/index')
+
+ const schema = getGraphqlBreakingChanges(currentVersion) as BreakingChangesT
+
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+ const manualContent = await extractManualContent(page, context)
+
+ const slugger = new GithubSlugger()
+
+ // Process breaking changes by date
+ const breakingChangesByDate = Object.keys(schema).map((date) => {
+ const items = schema[date]
+ const heading = `Changes scheduled for ${date}`
+ const slug = slugger.slug(heading)
+
+ return {
+ date,
+ heading,
+ slug,
+ items: items.map((item) => ({
+ location: item.location,
+ description: fastTextOnly(item.description),
+ reason: fastTextOnly(item.reason),
+ criticality: item.criticality,
+ })),
+ }
+ })
+
+ const templateData: Record = {
+ pageTitle: page.title,
+ pageIntro: intro,
+ manualContent,
+ breakingChangesByDate,
+ }
+
+ const templateContent = loadTemplate(this.templateName)
+
+ return await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+ }
+}
diff --git a/src/article-api/transformers/graphql-changelog-transformer.ts b/src/article-api/transformers/graphql-changelog-transformer.ts
new file mode 100644
index 000000000000..0e3b504cbce0
--- /dev/null
+++ b/src/article-api/transformers/graphql-changelog-transformer.ts
@@ -0,0 +1,69 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer } from './types'
+import type { ChangelogItemT } from '@/graphql/components/types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import { fastTextOnly } from '@/content-render/unified/text-only'
+import { extractManualContent } from '@/article-api/lib/graphql-helpers'
+
+/**
+ * Transformer for GraphQL changelog page
+ * Renders the changelog with schema changes, preview changes, and upcoming changes
+ */
+export class GraphQLChangelogTransformer implements PageTransformer {
+ templateName = 'graphql-changelog.template.md'
+
+ canTransform(page: Page): boolean {
+ if (page.autogenerated !== 'graphql') return false
+
+ return page.relativePath.includes('graphql/overview/changelog')
+ }
+
+ async transform(page: Page, _pathname: string, context: Context): Promise {
+ const currentVersion = context.currentVersion!
+
+ const { getGraphqlChangelog } = await import('@/graphql/lib/index')
+
+ const schema = getGraphqlChangelog(currentVersion) as ChangelogItemT[]
+
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+ const manualContent = await extractManualContent(page, context)
+
+ // Process changelog items
+ const changelogItems = schema.map((item) => {
+ const processChanges = (changes: Array<{ title: string; changes: string[] }>) =>
+ changes.map((change) => ({
+ title: change.title,
+ changes: change.changes.map((html: string) => {
+ // Remove wrapping tags if present
+ if (html.startsWith('
') && html.endsWith('
')) {
+ return fastTextOnly(html.slice(3, -4))
+ }
+ return fastTextOnly(html)
+ }),
+ }))
+
+ return {
+ date: item.date,
+ schemaChanges: processChanges(item.schemaChanges || []),
+ previewChanges: processChanges(item.previewChanges || []),
+ upcomingChanges: processChanges(item.upcomingChanges || []),
+ }
+ })
+
+ const templateData: Record = {
+ pageTitle: page.title,
+ pageIntro: intro,
+ manualContent,
+ changelogItems,
+ }
+
+ const templateContent = loadTemplate(this.templateName)
+
+ return await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+ }
+}
diff --git a/src/article-api/transformers/graphql-index-transformer.ts b/src/article-api/transformers/graphql-index-transformer.ts
new file mode 100644
index 000000000000..b46b41cf9100
--- /dev/null
+++ b/src/article-api/transformers/graphql-index-transformer.ts
@@ -0,0 +1,55 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer } from './types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import { extractManualContent } from '@/article-api/lib/graphql-helpers'
+
+/**
+ * Transformer for GraphQL reference index page
+ * Renders the index page with links to child pages
+ */
+export class GraphQLIndexTransformer implements PageTransformer {
+ templateName = 'graphql-index.template.md'
+
+ canTransform(page: Page): boolean {
+ if (page.autogenerated !== 'graphql') return false
+
+ // Match the reference index page (no specific page type after /reference)
+ return page.relativePath.endsWith('graphql/reference/index.md')
+ }
+
+ async transform(page: Page, _pathname: string, context: Context): Promise {
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+
+ const manualContent = await extractManualContent(page, context)
+
+ // Get children links from page metadata
+ const children = page.children || []
+ const childrenLinks = children
+ .map((child) => {
+ const childPath = child.startsWith('/') ? child : `/${child}`
+ const childName = childPath.split('/').pop() || ''
+ const displayName = childName
+ .split('-')
+ .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+ .join(' ')
+ return `- [${displayName}](${childPath})`
+ })
+ .join('\n')
+
+ const templateData: Record = {
+ pageTitle: page.title,
+ pageIntro: intro,
+ manualContent,
+ childrenLinks,
+ }
+
+ const templateContent = loadTemplate(this.templateName)
+
+ return await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+ }
+}
diff --git a/src/article-api/transformers/graphql-reference-transformer.ts b/src/article-api/transformers/graphql-reference-transformer.ts
new file mode 100644
index 000000000000..418ad9ef5ff9
--- /dev/null
+++ b/src/article-api/transformers/graphql-reference-transformer.ts
@@ -0,0 +1,273 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer } from './types'
+import type {
+ QueryT,
+ MutationT,
+ ObjectT,
+ InterfaceT,
+ EnumT,
+ UnionT,
+ InputObjectT,
+ ScalarT,
+ FieldT,
+} from '@/graphql/components/types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import { fastTextOnly } from '@/content-render/unified/text-only'
+import { extractManualContent } from '@/article-api/lib/graphql-helpers'
+
+/**
+ * Transformer for GraphQL reference pages (queries, mutations, objects, etc.)
+ * Renders schema items with their fields and arguments
+ */
+export class GraphQLReferenceTransformer implements PageTransformer {
+ templateName = 'graphql-reference.template.md'
+
+ canTransform(page: Page): boolean {
+ if (page.autogenerated !== 'graphql') return false
+
+ // Match reference pages that have a specific page type (not index)
+ const isReference = page.relativePath.includes('graphql/reference/')
+ const isNotIndex = !page.relativePath.endsWith('index.md')
+
+ return isReference && isNotIndex
+ }
+
+ async transform(page: Page, pathname: string, context: Context): Promise {
+ const currentVersion = context.currentVersion!
+
+ // Determine the page type from the pathname
+ const pathParts = pathname.split('/').filter(Boolean)
+ const graphqlIndex = pathParts.indexOf('graphql')
+ const pageType = pathParts[graphqlIndex + 2] // specific page like 'queries', 'mutations', etc.
+
+ // Import GraphQL data functions dynamically
+ const { getGraphqlSchema } = await import('@/graphql/lib/index')
+
+ // Map URL-friendly page type to internal schema key
+ const schemaKey = pageType === 'input-objects' ? 'inputObjects' : pageType
+
+ const schema = getGraphqlSchema(currentVersion, schemaKey)
+
+ // Prepare intro and manual content
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+ const manualContent = await extractManualContent(page, context)
+
+ // Prepare the schema items based on page type
+ let preparedItems: Array> = []
+
+ switch (schemaKey) {
+ case 'queries':
+ preparedItems = await Promise.all(
+ (schema as QueryT[]).map((item) => this.prepareQuery(item)),
+ )
+ break
+ case 'mutations':
+ preparedItems = await Promise.all(
+ (schema as MutationT[]).map((item) => this.prepareMutation(item)),
+ )
+ break
+ case 'objects':
+ preparedItems = await Promise.all(
+ (schema as ObjectT[]).map((item) => this.prepareObject(item)),
+ )
+ break
+ case 'interfaces':
+ preparedItems = await Promise.all(
+ (schema as InterfaceT[]).map((item) => this.prepareInterface(item)),
+ )
+ break
+ case 'enums':
+ preparedItems = await Promise.all((schema as EnumT[]).map((item) => this.prepareEnum(item)))
+ break
+ case 'unions':
+ preparedItems = await Promise.all(
+ (schema as UnionT[]).map((item) => this.prepareUnion(item)),
+ )
+ break
+ case 'inputObjects':
+ preparedItems = await Promise.all(
+ (schema as InputObjectT[]).map((item) => this.prepareInputObject(item)),
+ )
+ break
+ case 'scalars':
+ preparedItems = await Promise.all(
+ (schema as ScalarT[]).map((item) => this.prepareScalar(item)),
+ )
+ break
+ }
+
+ const templateData: Record = {
+ pageTitle: page.title,
+ pageIntro: intro,
+ manualContent,
+ items: preparedItems,
+ pageType: schemaKey,
+ }
+
+ const templateContent = loadTemplate(this.templateName)
+
+ return await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+ }
+
+ /**
+ * Prepare a query item for rendering
+ */
+ private async prepareQuery(query: QueryT): Promise> {
+ return {
+ name: query.name,
+ slug: query.name.toLowerCase(),
+ description: query.description ? fastTextOnly(query.description) : '',
+ type: query.type,
+ href: query.href,
+ isDeprecated: query.isDeprecated || false,
+ deprecationReason: query.deprecationReason
+ ? fastTextOnly(query.deprecationReason)
+ : undefined,
+ args: query.args.map((arg) => ({
+ name: arg.name,
+ type: arg.type,
+ href: arg.href,
+ description: arg.description ? fastTextOnly(arg.description) : '',
+ })),
+ }
+ }
+
+ /**
+ * Prepare a mutation item for rendering
+ */
+ private async prepareMutation(mutation: MutationT): Promise> {
+ return {
+ name: mutation.name,
+ slug: mutation.name.toLowerCase(),
+ description: mutation.description ? fastTextOnly(mutation.description) : '',
+ isDeprecated: mutation.isDeprecated || false,
+ deprecationReason: mutation.deprecationReason
+ ? fastTextOnly(mutation.deprecationReason)
+ : undefined,
+ inputFields: await this.prepareFields(mutation.inputFields),
+ returnFields: await this.prepareFields(mutation.returnFields),
+ }
+ }
+
+ /**
+ * Prepare an object item for rendering
+ */
+ private async prepareObject(object: ObjectT): Promise> {
+ return {
+ name: object.name,
+ slug: object.name.toLowerCase(),
+ description: object.description ? fastTextOnly(object.description) : '',
+ isDeprecated: object.isDeprecated || false,
+ deprecationReason: object.deprecationReason
+ ? fastTextOnly(object.deprecationReason)
+ : undefined,
+ implements: object.implements || [],
+ fields: await this.prepareFields(object.fields),
+ }
+ }
+
+ /**
+ * Prepare an interface item for rendering
+ */
+ private async prepareInterface(item: InterfaceT): Promise> {
+ return {
+ name: item.name,
+ slug: item.name.toLowerCase(),
+ description: item.description ? fastTextOnly(item.description) : '',
+ isDeprecated: item.isDeprecated || false,
+ deprecationReason: item.deprecationReason ? fastTextOnly(item.deprecationReason) : undefined,
+ fields: await this.prepareFields(item.fields),
+ }
+ }
+
+ /**
+ * Prepare an enum item for rendering
+ */
+ private async prepareEnum(item: EnumT): Promise> {
+ return {
+ name: item.name,
+ slug: item.name.toLowerCase(),
+ description: item.description ? fastTextOnly(item.description) : '',
+ isDeprecated: item.isDeprecated || false,
+ deprecationReason: item.deprecationReason ? fastTextOnly(item.deprecationReason) : undefined,
+ values: item.values.map((value) => ({
+ name: value.name,
+ description: value.description ? fastTextOnly(value.description) : '',
+ })),
+ }
+ }
+
+ /**
+ * Prepare a union item for rendering
+ */
+ private async prepareUnion(item: UnionT): Promise> {
+ return {
+ name: item.name,
+ slug: item.name.toLowerCase(),
+ description: item.description ? fastTextOnly(item.description) : '',
+ isDeprecated: item.isDeprecated || false,
+ deprecationReason: item.deprecationReason ? fastTextOnly(item.deprecationReason) : undefined,
+ possibleTypes: item.possibleTypes || [],
+ }
+ }
+
+ /**
+ * Prepare an input object item for rendering
+ */
+ private async prepareInputObject(item: InputObjectT): Promise> {
+ return {
+ name: item.name,
+ slug: item.name.toLowerCase(),
+ description: item.description ? fastTextOnly(item.description) : '',
+ isDeprecated: item.isDeprecated || false,
+ deprecationReason: item.deprecationReason ? fastTextOnly(item.deprecationReason) : undefined,
+ inputFields: await this.prepareFields(item.inputFields),
+ }
+ }
+
+ /**
+ * Prepare a scalar item for rendering
+ */
+ private async prepareScalar(item: ScalarT): Promise> {
+ return {
+ name: item.name,
+ slug: item.name.toLowerCase(),
+ description: item.description ? fastTextOnly(item.description) : '',
+ isDeprecated: item.isDeprecated || false,
+ deprecationReason: item.deprecationReason ? fastTextOnly(item.deprecationReason) : undefined,
+ }
+ }
+
+ /**
+ * Prepare fields for rendering
+ */
+ private async prepareFields(fields: FieldT[]): Promise>> {
+ return fields.map((field) => ({
+ name: field.name,
+ type: field.type,
+ href: field.href,
+ description: field.description ? fastTextOnly(field.description) : '',
+ defaultValue: field.defaultValue,
+ isDeprecated: field.isDeprecated || false,
+ deprecationReason: field.deprecationReason
+ ? fastTextOnly(field.deprecationReason)
+ : undefined,
+ arguments: field.arguments
+ ? field.arguments.map((arg) => ({
+ name: arg.name,
+ description: arg.description ? fastTextOnly(arg.description) : '',
+ defaultValue: arg.defaultValue,
+ type: {
+ name: arg.type.name,
+ href: arg.type.href,
+ },
+ }))
+ : undefined,
+ }))
+ }
+}
diff --git a/src/article-api/transformers/index.ts b/src/article-api/transformers/index.ts
new file mode 100644
index 000000000000..b65f846dca9f
--- /dev/null
+++ b/src/article-api/transformers/index.ts
@@ -0,0 +1,47 @@
+import { TransformerRegistry } from './types'
+import { RestTransformer } from './rest-transformer'
+import { SecretScanningTransformer } from './secret-scanning-transformer'
+import { CodeQLCliTransformer } from './codeql-cli-transformer'
+import { AuditLogsTransformer } from './audit-logs-transformer'
+import { GraphQLIndexTransformer } from './graphql-index-transformer'
+import { GraphQLReferenceTransformer } from './graphql-reference-transformer'
+import { GraphQLChangelogTransformer } from './graphql-changelog-transformer'
+import { GraphQLBreakingChangesTransformer } from './graphql-breaking-changes-transformer'
+import { GithubAppsTransformer } from './github-apps-transformer'
+import { WebhooksTransformer } from './webhooks-transformer'
+import { TocTransformer } from './toc-transformer'
+import { BespokeLandingTransformer } from './bespoke-landing-transformer'
+import { JourneyLandingTransformer } from './journey-landing-transformer'
+import { CategoryLandingTransformer } from './category-landing-transformer'
+import { DiscoveryLandingTransformer } from './discovery-landing-transformer'
+import { ProductGuidesTransformer } from './product-guides-transformer'
+import { ProductLandingTransformer } from './product-landing-transformer'
+import { SearchPageTransformer } from './search-page-transformer'
+
+/**
+ * Global transformer registry
+ * Registers all available page-to-markdown transformers
+ */
+export const transformerRegistry = new TransformerRegistry()
+
+transformerRegistry.register(new RestTransformer())
+transformerRegistry.register(new SecretScanningTransformer())
+transformerRegistry.register(new CodeQLCliTransformer())
+transformerRegistry.register(new AuditLogsTransformer())
+transformerRegistry.register(new GraphQLIndexTransformer())
+transformerRegistry.register(new GraphQLReferenceTransformer())
+transformerRegistry.register(new GraphQLChangelogTransformer())
+transformerRegistry.register(new GraphQLBreakingChangesTransformer())
+transformerRegistry.register(new GithubAppsTransformer())
+transformerRegistry.register(new WebhooksTransformer())
+transformerRegistry.register(new TocTransformer())
+transformerRegistry.register(new BespokeLandingTransformer())
+transformerRegistry.register(new JourneyLandingTransformer())
+transformerRegistry.register(new CategoryLandingTransformer())
+transformerRegistry.register(new DiscoveryLandingTransformer())
+transformerRegistry.register(new ProductGuidesTransformer())
+transformerRegistry.register(new ProductLandingTransformer())
+transformerRegistry.register(new SearchPageTransformer())
+
+export { TransformerRegistry } from './types'
+export type { PageTransformer } from './types'
diff --git a/src/article-api/transformers/journey-landing-transformer.ts b/src/article-api/transformers/journey-landing-transformer.ts
new file mode 100644
index 000000000000..959b28deaf6a
--- /dev/null
+++ b/src/article-api/transformers/journey-landing-transformer.ts
@@ -0,0 +1,115 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer, TemplateData, Section, LinkData, LinkGroup } from './types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import { resolvePath } from '@/article-api/lib/resolve-path'
+import { getLinkData } from '@/article-api/lib/get-link-data'
+
+interface JourneyGuide {
+ href: string
+ alternativeNextStep?: string
+}
+
+interface JourneyTrack {
+ id: string
+ title: string
+ description: string
+ guides: JourneyGuide[]
+}
+
+interface JourneyPage extends Page {
+ journeyTracks?: JourneyTrack[]
+ children?: string[]
+}
+
+/**
+ * Transforms journey-landing pages into markdown format.
+ * Handles journey tracks (grouped learning paths) with guides,
+ * falling back to children listings when tracks aren't available.
+ */
+export class JourneyLandingTransformer implements PageTransformer {
+ templateName = 'landing-page.template.md'
+
+ canTransform(page: Page): boolean {
+ return page.layout === 'journey-landing'
+ }
+
+ async transform(page: Page, pathname: string, context: Context): Promise {
+ const templateData = await this.prepareTemplateData(page, pathname, context)
+ const templateContent = loadTemplate(this.templateName)
+
+ return await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+ }
+
+ private async prepareTemplateData(
+ page: Page,
+ pathname: string,
+ context: Context,
+ ): Promise {
+ const journeyPage = page as JourneyPage
+ const languageCode = page.languageCode || 'en'
+ const sections: Section[] = []
+
+ // Journey tracks
+ const journeyTracks = journeyPage.journeyTracks
+ if (journeyTracks) {
+ const groups: LinkGroup[] = []
+ for (const track of journeyTracks) {
+ const links = await Promise.all(
+ (track.guides || []).map(async (guide) => {
+ const guideHref = guide.href
+ if (!guideHref) return null
+ const linkData = await getLinkData(
+ guideHref,
+ languageCode,
+ pathname,
+ context,
+ resolvePath,
+ )
+ return linkData
+ }),
+ )
+ const validLinks = links.filter((l): l is LinkData => l !== null && !!l.href)
+ if (validLinks.length > 0) {
+ groups.push({ title: track.title, links: validLinks })
+ }
+ }
+
+ if (groups.length > 0) {
+ sections.push({
+ title: 'Links',
+ groups,
+ })
+ }
+ }
+
+ // Children fallback
+ if (sections.length === 0 && journeyPage.children) {
+ const links = await Promise.all(
+ journeyPage.children.map(async (childHref) => {
+ return await getLinkData(childHref, languageCode, pathname, context, resolvePath)
+ }),
+ )
+ const validLinks = links.filter((l): l is LinkData => !!l.href)
+ if (validLinks.length > 0) {
+ sections.push({
+ title: 'Links',
+ groups: [{ title: null, links: validLinks }],
+ })
+ }
+ }
+
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+ const title = await page.renderTitle(context, { unwrap: true })
+
+ return {
+ title,
+ intro,
+ sections,
+ }
+ }
+}
diff --git a/src/article-api/transformers/product-guides-transformer.ts b/src/article-api/transformers/product-guides-transformer.ts
new file mode 100644
index 000000000000..54d54b00b4aa
--- /dev/null
+++ b/src/article-api/transformers/product-guides-transformer.ts
@@ -0,0 +1,138 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer, TemplateData, Section, LinkGroup, LinkData } from './types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+
+interface ProcessedLink {
+ href: string
+ title?: string
+ intro?: string
+}
+
+interface LearningTrack {
+ title: string
+ guides: ProcessedLink[]
+}
+
+/**
+ * ProductGuidesPage extends Page with optional guide and learning track fields.
+ * - includeGuides/rawIncludeGuides: Curated list of guide articles (processed objects vs raw paths)
+ * - learningTracks/rawLearningTracks: Grouped tutorials (processed objects vs raw track IDs)
+ */
+interface ProductGuidesPage extends Page {
+ includeGuides?: ProcessedLink[]
+ rawIncludeGuides?: string[]
+ learningTracks?: LearningTrack[]
+ rawLearningTracks?: string[]
+}
+
+/**
+ * Transforms product-guides pages into markdown format.
+ * Handles includeGuides (curated articles) and learningTracks (grouped tutorials).
+ */
+export class ProductGuidesTransformer implements PageTransformer {
+ templateName = 'landing-page.template.md'
+
+ canTransform(page: Page): boolean {
+ return page.layout === 'product-guides'
+ }
+
+ async transform(page: Page, pathname: string, context: Context): Promise {
+ const templateData = await this.prepareTemplateData(page, pathname, context)
+ const templateContent = loadTemplate(this.templateName)
+
+ return await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+ }
+
+ private async prepareTemplateData(
+ page: Page,
+ pathname: string,
+ context: Context,
+ ): Promise {
+ const guidesPage = page as ProductGuidesPage
+ const sections: Section[] = []
+ const groups: LinkGroup[] = []
+
+ // Include guides
+ const includeGuidesData = guidesPage.includeGuides ?? guidesPage.rawIncludeGuides
+ if (includeGuidesData && includeGuidesData.length > 0) {
+ const { default: getLinkData } = await import('@/learning-track/lib/get-link-data')
+
+ const isProcessed = typeof includeGuidesData[0] === 'object'
+
+ let processedLinks: ProcessedLink[]
+ if (isProcessed) {
+ processedLinks = includeGuidesData as ProcessedLink[]
+ } else {
+ processedLinks =
+ (await getLinkData(includeGuidesData as string[], context, {
+ title: true,
+ intro: true,
+ })) || []
+ }
+
+ const links: LinkData[] = (processedLinks || []).map((item) => ({
+ href: item.href,
+ title: item.title || '',
+ intro: item.intro || '',
+ }))
+
+ const validLinks = links.filter((l) => l.href)
+ if (validLinks.length > 0) {
+ groups.push({ title: 'Guides', links: validLinks })
+ }
+ }
+
+ // Learning tracks
+ const learningTracksData = guidesPage.learningTracks ?? guidesPage.rawLearningTracks
+ if (learningTracksData && learningTracksData.length > 0) {
+ let processedTracks: LearningTrack[]
+ if (Array.isArray(guidesPage.learningTracks) && guidesPage.learningTracks.length > 0) {
+ processedTracks = guidesPage.learningTracks
+ } else {
+ const { default: processLearningTracks } = await import(
+ '@/learning-track/lib/process-learning-tracks'
+ )
+ const { learningTracks } = await processLearningTracks(
+ learningTracksData as string[],
+ context,
+ )
+ processedTracks = learningTracks
+ }
+
+ for (const track of processedTracks) {
+ if (!track.guides || !Array.isArray(track.guides)) continue
+
+ const links: LinkData[] = track.guides.map((guide) => ({
+ href: guide.href,
+ title: guide.title || '',
+ intro: guide.intro || '',
+ }))
+
+ if (links.length > 0) {
+ groups.push({ title: track.title, links })
+ }
+ }
+ }
+
+ if (groups.length > 0) {
+ sections.push({
+ title: 'Links',
+ groups,
+ })
+ }
+
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+ const title = await page.renderTitle(context, { unwrap: true })
+
+ return {
+ title,
+ intro,
+ sections,
+ }
+ }
+}
diff --git a/src/article-api/transformers/product-landing-transformer.ts b/src/article-api/transformers/product-landing-transformer.ts
new file mode 100644
index 000000000000..7c089d4d2dca
--- /dev/null
+++ b/src/article-api/transformers/product-landing-transformer.ts
@@ -0,0 +1,301 @@
+import type { Context, Page, ResolvedArticle } from '@/types'
+import type { PageTransformer, TemplateData, Section, LinkGroup, LinkData } from './types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import { resolvePath } from '@/article-api/lib/resolve-path'
+import { getLinkData } from '@/article-api/lib/get-link-data'
+
+interface ProductPage extends Omit {
+ featuredLinks?: Record>
+ children?: string[]
+ carousels?: Record
+ rawCarousels?: Record
+ includedCategories?: string[]
+}
+
+interface PageWithChildren extends Page {
+ children?: string[]
+ category?: string[]
+}
+
+/**
+ * Transforms product-landing pages into markdown format.
+ * Handles featured links (startHere, popular, videos), guide cards,
+ * article grids with category filtering, and children listings.
+ */
+export class ProductLandingTransformer implements PageTransformer {
+ templateName = 'landing-page.template.md'
+
+ canTransform(page: Page): boolean {
+ return page.layout === 'product-landing'
+ }
+
+ async transform(page: Page, pathname: string, context: Context): Promise {
+ const templateData = await this.prepareTemplateData(page, pathname, context)
+
+ const templateContent = loadTemplate(this.templateName)
+
+ const rendered = await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+
+ return rendered
+ }
+
+ private async prepareTemplateData(
+ page: Page,
+ pathname: string,
+ context: Context,
+ ): Promise {
+ const productPage = page as ProductPage
+ const languageCode = page.languageCode || 'en'
+ const sections: Section[] = []
+
+ // Process carousels (each carousel becomes a section)
+ const carousels = productPage.carousels ?? productPage.rawCarousels
+ if (carousels && typeof carousels === 'object') {
+ const { default: getLearningTrackLinkData } = await import(
+ '@/learning-track/lib/get-link-data'
+ )
+
+ for (const [carouselKey, articles] of Object.entries(carousels)) {
+ if (!Array.isArray(articles) || articles.length === 0) continue
+
+ let links: LinkData[]
+ if (typeof articles[0] === 'object' && 'title' in articles[0]) {
+ // Already resolved articles
+ links = articles.map((item) => ({
+ href: typeof item === 'string' ? item : item.href,
+ title: (typeof item === 'object' && item.title) || '',
+ intro: (typeof item === 'object' && item.intro) || '',
+ }))
+ } else {
+ // Raw paths that need resolution
+ const linkData = await getLearningTrackLinkData(articles as string[], context, {
+ title: true,
+ intro: true,
+ })
+ links = (linkData || []).map(
+ (item: { href: string; title?: string; intro?: string }) => ({
+ href: item.href,
+ title: item.title || '',
+ intro: item.intro || '',
+ }),
+ )
+ }
+
+ const validLinks = links.filter((l) => l.href && l.title)
+ if (validLinks.length > 0) {
+ // Use carousel key as title (capitalize first letter)
+ const sectionTitle = carouselKey.charAt(0).toUpperCase() + carouselKey.slice(1)
+ sections.push({
+ title: sectionTitle,
+ groups: [{ title: null, links: validLinks }],
+ })
+ }
+ }
+ }
+
+ // Featured links (startHere, popular, videos, etc.)
+ const rawFeaturedLinks = productPage.featuredLinks
+ if (rawFeaturedLinks) {
+ const { default: getLearningTrackLinkData } = await import(
+ '@/learning-track/lib/get-link-data'
+ )
+
+ const featuredKeys = ['startHere', 'popular', 'videos']
+ const featuredGroups: LinkGroup[] = []
+
+ for (const key of featuredKeys) {
+ const links = rawFeaturedLinks[key]
+ if (!Array.isArray(links) || links.length === 0) continue
+
+ const sectionTitle = this.getSectionTitle(key)
+
+ let resolvedLinks: LinkData[]
+
+ if (key === 'videos') {
+ // Videos are external URLs with title and href properties
+ const videoLinks = await Promise.all(
+ links.map(async (link) => {
+ if (typeof link === 'object' && link.href) {
+ const title = await renderContent(link.title, context, { textOnly: true })
+ return title ? { href: link.href, title, intro: link.intro || '' } : null
+ }
+ return null
+ }),
+ )
+ resolvedLinks = videoLinks.filter((l) => l !== null) as LinkData[]
+ } else {
+ // Other featuredLinks are page hrefs that need Liquid evaluation
+ const stringLinks = links.map((item) => (typeof item === 'string' ? item : item.href))
+ const linkData = await getLearningTrackLinkData(stringLinks, context, {
+ title: true,
+ intro: true,
+ })
+ resolvedLinks = (linkData || []).map((item) => ({
+ href: item.href,
+ title: item.title || '',
+ intro: item.intro || '',
+ }))
+ }
+
+ const validLinks = resolvedLinks.filter((l) => l.href)
+ if (validLinks.length > 0) {
+ featuredGroups.push({
+ title: sectionTitle,
+ links: validLinks,
+ })
+ }
+ }
+
+ if (featuredGroups.length > 0) {
+ sections.push({
+ title: 'Featured',
+ groups: featuredGroups,
+ })
+ }
+ }
+
+ // Guide cards
+ if (rawFeaturedLinks?.guideCards) {
+ const links = rawFeaturedLinks.guideCards
+ if (Array.isArray(links)) {
+ const resolvedLinks = await Promise.all(
+ links.map(async (link) => {
+ if (typeof link === 'string') {
+ return await getLinkData(link, languageCode, pathname, context, resolvePath)
+ } else if (link.href) {
+ return {
+ href: link.href,
+ title: link.title,
+ intro: link.intro || '',
+ }
+ }
+ return null
+ }),
+ )
+
+ const validLinks = resolvedLinks.filter((l): l is LinkData => l !== null && !!l.href)
+ if (validLinks.length > 0) {
+ sections.push({
+ title: 'Guides',
+ groups: [{ title: null, links: validLinks }],
+ })
+ }
+ }
+ }
+
+ // Article grid with includedCategories filtering
+ if (productPage.children && productPage.includedCategories) {
+ const gridGroups: LinkGroup[] = []
+ const includedCategories = productPage.includedCategories
+
+ for (const childHref of productPage.children) {
+ const childPage = resolvePath(childHref, languageCode, pathname, context) as
+ | PageWithChildren
+ | undefined
+ if (!childPage?.children) continue
+
+ const childChildren = childPage.children
+ if (childChildren.length === 0) continue
+
+ // Get the child page's pathname to use for resolving grandchildren
+ const childPermalink = childPage.permalinks.find(
+ (p) => p.languageCode === languageCode && p.pageVersion === context.currentVersion,
+ )
+ const childPathname = childPermalink ? childPermalink.href : pathname + childHref
+
+ const articles = await Promise.all(
+ childChildren.map(async (grandchildHref: string) => {
+ const linkData = await getLinkData(
+ grandchildHref,
+ languageCode,
+ childPathname,
+ context,
+ resolvePath,
+ )
+
+ if (includedCategories.length > 0) {
+ const linkedPage = resolvePath(
+ grandchildHref,
+ languageCode,
+ childPathname,
+ context,
+ ) as PageWithChildren | undefined
+ if (linkedPage) {
+ const pageCategories = linkedPage.category || []
+ const hasMatchingCategory =
+ Array.isArray(pageCategories) &&
+ pageCategories.some((cat: string) =>
+ includedCategories.some(
+ (included) => included.toLowerCase() === cat.toLowerCase(),
+ ),
+ )
+ if (!hasMatchingCategory) {
+ return null
+ }
+ }
+ }
+
+ return linkData
+ }),
+ )
+
+ const validArticles = articles.filter((a): a is LinkData => a !== null && !!a.href)
+ if (validArticles.length > 0) {
+ const childTitle = await childPage.renderTitle(context, { unwrap: true })
+ gridGroups.push({
+ title: childTitle,
+ links: validArticles,
+ })
+ }
+ }
+
+ if (gridGroups.length > 0) {
+ sections.push({
+ title: 'Articles',
+ groups: gridGroups,
+ })
+ }
+ }
+
+ // All children (full listing)
+ if (productPage.children) {
+ const links = await Promise.all(
+ productPage.children.map(async (childHref) => {
+ return await getLinkData(childHref, languageCode, pathname, context, resolvePath)
+ }),
+ )
+ const validLinks = links.filter((l) => l.href)
+ if (validLinks.length > 0) {
+ sections.push({
+ title: 'Links',
+ groups: [{ title: null, links: validLinks }],
+ })
+ }
+ }
+
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+ const title = await page.renderTitle(context, { unwrap: true })
+
+ return {
+ title,
+ intro,
+ sections,
+ }
+ }
+
+ private getSectionTitle(key: string): string {
+ const map: Record = {
+ gettingStarted: 'Getting started',
+ startHere: 'Start here',
+ guideCards: 'Guides',
+ popular: 'Popular',
+ videos: 'Videos',
+ }
+ return map[key] || key
+ }
+}
diff --git a/src/article-api/transformers/rest-transformer.ts b/src/article-api/transformers/rest-transformer.ts
new file mode 100644
index 000000000000..2ef6f845d8c9
--- /dev/null
+++ b/src/article-api/transformers/rest-transformer.ts
@@ -0,0 +1,212 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer } from './types'
+import type { Operation } from '@/rest/components/types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import matter from '@gr2m/gray-matter'
+import { fastTextOnly } from '@/content-render/unified/text-only'
+
+const DEBUG = process.env.RUNNER_DEBUG === '1' || process.env.DEBUG === '1'
+
+/**
+ * Transformer for REST API pages
+ * Converts REST operations and their data into markdown format using a Liquid template
+ */
+export class RestTransformer implements PageTransformer {
+ templateName = 'rest-page.template.md'
+
+ canTransform(page: Page): boolean {
+ // Only transform REST pages that are not landing pages
+ // Landing pages (like /en/rest) will be handled by a separate transformer
+ return page.autogenerated === 'rest' && !page.relativePath.endsWith('index.md')
+ }
+
+ async transform(
+ page: Page,
+ pathname: string,
+ context: Context,
+ apiVersion?: string,
+ ): Promise {
+ const startTime = DEBUG ? Date.now() : 0
+ if (DEBUG) console.log(`[DEBUG] RestTransformer: ${pathname}`)
+
+ // Import getRest dynamically to avoid circular dependencies
+ const { default: getRest } = await import('@/rest/lib/index')
+
+ // Extract version from context
+ const currentVersion = context.currentVersion!
+
+ // Use the provided apiVersion, or fall back to the latest from context
+ const effectiveApiVersion =
+ apiVersion ||
+ (context.currentVersionObj?.apiVersions?.length
+ ? context.currentVersionObj.latestApiVersion
+ : undefined)
+
+ // Parse the category and subcategory from the page path
+ // e.g. /en/rest/actions/artifacts -> category: actions, subcategory: artifacts
+ const pathParts = pathname.split('/').filter(Boolean)
+ const restIndex = pathParts.indexOf('rest')
+
+ if (restIndex === -1 || restIndex >= pathParts.length - 1) {
+ throw new Error(`Invalid REST path: ${pathname}`)
+ }
+
+ const category = pathParts[restIndex + 1]
+ const subcategory = pathParts[restIndex + 2] // May be undefined for category-only pages
+
+ // Get the REST operations data
+ const restData = await getRest(currentVersion, effectiveApiVersion)
+
+ let operations: Operation[] = []
+
+ if (subcategory && restData[category]?.[subcategory]) {
+ operations = restData[category][subcategory]
+ } else if (category && restData[category]) {
+ // For categories without subcategories, operations are nested directly
+ const categoryData = restData[category]
+ // Flatten all operations from all subcategories
+ operations = Object.values(categoryData).flat()
+ }
+
+ // Prepare manual content
+ let manualContent = ''
+ if (page.markdown) {
+ const markerIndex = page.markdown.indexOf(
+ '',
+ )
+ if (markerIndex > 0) {
+ const { content } = matter(page.markdown)
+ const manualContentMarkerIndex = content.indexOf(
+ '',
+ )
+ if (manualContentMarkerIndex > 0) {
+ const rawManualContent = content.substring(0, manualContentMarkerIndex).trim()
+ if (rawManualContent) {
+ manualContent = await renderContent(rawManualContent, {
+ ...context,
+ markdownRequested: true,
+ })
+ }
+ }
+ }
+ }
+
+ // Prepare data for template
+ const templateData = await this.prepareTemplateData(
+ page,
+ operations,
+ context,
+ manualContent,
+ effectiveApiVersion,
+ )
+
+ // Load and render template
+ const templateContent = loadTemplate(this.templateName)
+
+ // Render the template with Liquid
+ const rendered = await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+
+ if (DEBUG) console.log(`[DEBUG] RestTransformer completed in ${Date.now() - startTime}ms`)
+ return rendered
+ }
+
+ /**
+ * Prepare data for the Liquid template
+ */
+ private async prepareTemplateData(
+ page: Page,
+ operations: Operation[],
+ context: Context,
+ manualContent: string,
+ apiVersion?: string,
+ ): Promise> {
+ // Prepare page intro
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+
+ // Prepare operations for the template
+ const preparedOperations = await Promise.all(
+ operations.map(async (operation) => await this.prepareOperation(operation)),
+ )
+
+ return {
+ page: {
+ title: page.title,
+ intro,
+ },
+ manualContent,
+ restOperations: preparedOperations,
+ apiVersion,
+ }
+ }
+
+ /**
+ * Prepare a single operation for template rendering
+ */
+ private async prepareOperation(operation: Operation): Promise> {
+ // Convert HTML description to text
+ const description = operation.descriptionHTML ? fastTextOnly(operation.descriptionHTML) : ''
+
+ // Determine header settings
+ const needsContentTypeHeader = operation.subcategory === 'inference'
+ const omitHeaders =
+ operation.subcategory === 'management-console' || operation.subcategory === 'manage-ghes'
+ const showHeaders = !omitHeaders
+
+ // Check if operation has parameters
+ const hasParameters =
+ (operation.parameters?.length || 0) > 0 || (operation.bodyParameters?.length || 0) > 0
+
+ // Process status codes to convert HTML descriptions to plain text
+ const statusCodes = operation.statusCodes?.map((statusCode) => ({
+ ...statusCode,
+ description: statusCode.description ? fastTextOnly(statusCode.description) : undefined,
+ }))
+
+ // Prepare code examples with processed URLs
+ const codeExamples =
+ operation.codeExamples?.map((example) => {
+ let url = `${operation.serverUrl}${operation.requestPath}`
+
+ // Replace path parameters in URL
+ if (example.request?.parameters && Object.keys(example.request.parameters).length > 0) {
+ for (const [key, value] of Object.entries(example.request.parameters)) {
+ url = url.replace(`{${key}}`, String(value))
+ }
+ }
+
+ return {
+ request: {
+ description: example.request?.description
+ ? fastTextOnly(example.request.description)
+ : '',
+ url,
+ acceptHeader: example.request?.acceptHeader,
+ bodyParameters: example.request?.bodyParameters
+ ? JSON.stringify(example.request.bodyParameters, null, 2)
+ : null,
+ },
+ response: {
+ statusCode: example.response?.statusCode,
+ schema: (example.response as any)?.schema
+ ? JSON.stringify((example.response as any).schema, null, 2)
+ : null,
+ },
+ }
+ }) || []
+
+ return {
+ ...operation,
+ description,
+ hasParameters,
+ showHeaders,
+ needsContentTypeHeader,
+ statusCodes,
+ codeExamples,
+ }
+ }
+}
diff --git a/src/article-api/transformers/search-page-transformer.ts b/src/article-api/transformers/search-page-transformer.ts
new file mode 100644
index 000000000000..c3756298ecc5
--- /dev/null
+++ b/src/article-api/transformers/search-page-transformer.ts
@@ -0,0 +1,28 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer } from './types'
+
+/**
+ * Transformer for the search page (/en/search).
+ * This is a special UI-only page with no markdown content.
+ * Returns minimal markdown with just the title.
+ */
+export class SearchPageTransformer implements PageTransformer {
+ templateName = ''
+
+ canTransform(page: Page): boolean {
+ // Only match the search page specifically
+ return page.relativePath === 'search/index.md'
+ }
+
+ async transform(page: Page, _pathname: string, context: Context): Promise {
+ const title = await page.renderTitle(context, { unwrap: true })
+ return `# ${title}
+
+Use the Search API to search programmatically:
+
+\`\`\`
+curl "https://docs.github.com/api/search?query=actions&language=en&version=free-pro-team@latest"
+\`\`\`
+`
+ }
+}
diff --git a/src/article-api/transformers/secret-scanning-transformer.ts b/src/article-api/transformers/secret-scanning-transformer.ts
new file mode 100644
index 000000000000..8bed61b8e2a5
--- /dev/null
+++ b/src/article-api/transformers/secret-scanning-transformer.ts
@@ -0,0 +1,95 @@
+import type { Context, Page, SecretScanningData } from '@/types'
+import type { PageTransformer } from './types'
+import fs from 'fs'
+import yaml from 'js-yaml'
+import path from 'path'
+import { getVersionInfo } from '@/app/lib/constants'
+import { liquid, renderContent } from '@/content-render/index'
+import { allVersions } from '@/versions/lib/all-versions'
+import { loadTemplate } from '@/article-api/lib/load-template'
+
+/**
+ * Transformer for Secret Scanning pages.
+ * Loads pattern data and converts secret scanning documentation into markdown format using a Liquid template.
+ * Used by the Article API to render Secret Scanning documentation dynamically.
+ */
+export class SecretScanningTransformer implements PageTransformer {
+ templateName = 'secret-scanning-page.template.md'
+
+ canTransform(page: Page): boolean {
+ return page.autogenerated === 'secret-scanning'
+ }
+
+ async transform(page: Page, _pathname: string, context: Context): Promise {
+ if (!context.secretScanningData) {
+ const currentVersion = context.currentVersion
+ if (!currentVersion) throw new Error('currentVersion is required')
+
+ const { isEnterpriseCloud, isEnterpriseServer } = getVersionInfo(currentVersion)
+ const versionPath = isEnterpriseCloud
+ ? 'ghec'
+ : isEnterpriseServer
+ ? `ghes-${allVersions[currentVersion].currentRelease}`
+ : 'fpt'
+
+ const secretScanningDir = path.join(process.cwd(), 'src/secret-scanning/data/pattern-docs')
+ const filepath = path.join(secretScanningDir, versionPath, 'public-docs.yml')
+
+ if (fs.existsSync(filepath)) {
+ const data = yaml.load(fs.readFileSync(filepath, 'utf-8')) as SecretScanningData[]
+
+ // Process Liquid in values
+ for (const entry of data) {
+ // Only process Liquid for the hasValidityCheck field, as in the middleware
+ if (typeof entry.hasValidityCheck === 'string' && entry.hasValidityCheck.includes('{%')) {
+ // Render Liquid and parse as YAML to get correct boolean type
+ entry.hasValidityCheck = yaml.load(
+ await liquid.parseAndRender(entry.hasValidityCheck, context),
+ ) as boolean
+ }
+
+ if (entry.isduplicate) {
+ entry.secretType += '
Token versions'
+ }
+ if (entry.ismultipart) {
+ entry.secretType += '
Multi-part secrets'
+ }
+ }
+
+ context.secretScanningData = data
+ } else {
+ // If the file does not exist, set to empty array to ensure predictable behavior
+ context.secretScanningData = []
+ }
+ }
+
+ context.markdownRequested = true
+ let content = await page.render(context)
+
+ // Strip HTML comments from the rendered content
+ content = content.replace(//gs, '')
+
+ // Normalize whitespace after stripping comments
+ content = content.replace(/\n{3,}/g, '\n\n').trim()
+
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+
+ // Prepare template data
+ const templateData: Record = {
+ page: {
+ title: page.title,
+ intro,
+ },
+ content,
+ }
+
+ // Load and render template
+ const templateContent = loadTemplate(this.templateName)
+
+ return await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+ }
+}
diff --git a/src/article-api/transformers/toc-transformer.ts b/src/article-api/transformers/toc-transformer.ts
new file mode 100644
index 000000000000..1ff9f79f1f9c
--- /dev/null
+++ b/src/article-api/transformers/toc-transformer.ts
@@ -0,0 +1,79 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer, TemplateData, Section } from './types'
+import { renderContent } from '@/content-render/index'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import { resolvePath } from '@/article-api/lib/resolve-path'
+import { getLinkData } from '@/article-api/lib/get-link-data'
+
+interface CategoryPage extends Page {
+ children?: string[]
+}
+
+/**
+ * Transformer for table of contents (TOC) landing pages - pages with children but no specific layout.
+ * These are simple navigation pages (category/subcategory/product/homepage) that list child pages with titles and intros.
+ * Corresponds to TocLanding component in the web UI.
+ */
+export class TocTransformer implements PageTransformer {
+ templateName = 'landing-page.template.md'
+
+ canTransform(page: Page): boolean {
+ // Transform pages that have children but no layout specified
+ // These are typically category, subcategory, product, or homepage pages
+ const categoryPage = page as CategoryPage
+ const validDocTypes = ['category', 'subcategory', 'product', 'homepage']
+ return (
+ !page.layout &&
+ validDocTypes.includes(page.documentType) &&
+ !!categoryPage.children &&
+ categoryPage.children.length > 0
+ )
+ }
+
+ async transform(page: Page, pathname: string, context: Context): Promise {
+ const templateData = await this.prepareTemplateData(page, pathname, context)
+ const templateContent = loadTemplate(this.templateName)
+
+ return await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+ }
+
+ private async prepareTemplateData(
+ page: Page,
+ pathname: string,
+ context: Context,
+ ): Promise {
+ const mapPage = page as CategoryPage
+ const languageCode = page.languageCode || 'en'
+ const sections: Section[] = []
+
+ // Get all child pages
+ if (mapPage.children?.length) {
+ const links = await Promise.all(
+ mapPage.children.map(async (childHref) => {
+ return await getLinkData(childHref, languageCode, pathname, context, resolvePath)
+ }),
+ )
+
+ const validLinks = links.filter((l) => l.href)
+ if (validLinks.length > 0) {
+ sections.push({
+ title: 'Links',
+ groups: [{ title: null, links: validLinks }],
+ })
+ }
+ }
+
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+ const title = await page.renderTitle(context, { unwrap: true })
+
+ return {
+ title,
+ intro,
+ sections,
+ }
+ }
+}
diff --git a/src/article-api/transformers/types.ts b/src/article-api/transformers/types.ts
new file mode 100644
index 000000000000..aa2441f816e2
--- /dev/null
+++ b/src/article-api/transformers/types.ts
@@ -0,0 +1,144 @@
+import type { Context, Page } from '@/types'
+
+/**
+ * Link data for landing page sections
+ */
+export interface LinkData {
+ href: string
+ title: string
+ intro?: string
+}
+
+/**
+ * Group of links with an optional title
+ */
+export interface LinkGroup {
+ title: string | null
+ links: LinkData[]
+}
+
+/**
+ * Section containing multiple link groups
+ */
+export interface Section {
+ title: string | null
+ groups: LinkGroup[]
+}
+
+/**
+ * Template data structure for landing pages
+ */
+export interface TemplateData {
+ title: string
+ intro: string
+ sections: Section[]
+}
+
+/**
+ * Base interface for page-to-markdown transformers
+ *
+ * Transformers convert autogenerated pages (REST, webhooks, etc.)
+ * into markdown format for the Article API
+ */
+export interface PageTransformer {
+ /**
+ * Optional: The name of the template file to use for rendering
+ * If provided, can be used by helper functions to load the template
+ * Example: 'landing-page.template.md'
+ */
+ templateName?: string
+
+ /**
+ * Check if this transformer can handle the given page
+ */
+ canTransform(page: Page): boolean
+
+ /**
+ * Transform the page into markdown format
+ * @param page - The page to transform
+ * @param pathname - The pathname of the page
+ * @param context - The rendering context
+ * @param apiVersion - Optional API version (e.g., '2022-11-28' for REST API calendar versioning)
+ */
+ transform(page: Page, pathname: string, context: Context, apiVersion?: string): Promise
+}
+
+/**
+ * Registry of available transformers for converting pages to markdown
+ *
+ * The TransformerRegistry manages a collection of PageTransformer instances
+ * and provides a mechanism to find the appropriate transformer for a given page.
+ *
+ * Transformers are evaluated in registration order. The first transformer
+ * whose `canTransform()` method returns true will be selected.
+ *
+ * @example
+ * ```typescript
+ * const registry = new TransformerRegistry()
+ *
+ * // Register transformers in priority order
+ * registry.register(new RestTransformer())
+ * registry.register(new WebhookTransformer())
+ * registry.register(new GraphQLTransformer())
+ *
+ * // Find and use a transformer
+ * const transformer = registry.findTransformer(page)
+ * if (transformer) {
+ * const markdown = await transformer.transform(page, pathname, context)
+ * }
+ * ```
+ *
+ * @remarks
+ * This class is not thread-safe. In server environments with concurrent requests,
+ * register all transformers during initialization before handling requests.
+ */
+export class TransformerRegistry {
+ private transformers: PageTransformer[] = []
+
+ /**
+ * Register a new transformer
+ *
+ * Transformers are evaluated in registration order when finding a match.
+ * Register more specific transformers before more general ones.
+ *
+ * @param transformer - The transformer to register
+ *
+ * @example
+ * ```typescript
+ * const registry = new TransformerRegistry()
+ * registry.register(new RestTransformer())
+ * ```
+ */
+ register(transformer: PageTransformer): void {
+ this.transformers.push(transformer)
+ }
+
+ /**
+ * Find a transformer that can handle the given page
+ *
+ * Iterates through registered transformers in registration order and returns
+ * the first transformer whose `canTransform()` method returns true.
+ *
+ * @param page - The page to find a transformer for
+ * @returns The first matching transformer, or null if:
+ * - The page is null/undefined
+ * - No registered transformer can handle the page
+ *
+ * @example
+ * ```typescript
+ * const transformer = registry.findTransformer(page)
+ * if (transformer) {
+ * const markdown = await transformer.transform(page, pathname, context)
+ * } else {
+ * // Handle case where no transformer is available
+ * console.warn('No transformer found for page:', page.relativePath)
+ * }
+ * ```
+ */
+ findTransformer(page: Page): PageTransformer | null {
+ if (page == null) {
+ return null
+ }
+ return this.transformers.find((t) => t.canTransform(page)) || null
+ }
+}
diff --git a/src/article-api/transformers/webhooks-transformer.ts b/src/article-api/transformers/webhooks-transformer.ts
new file mode 100644
index 000000000000..d30e84a08fb0
--- /dev/null
+++ b/src/article-api/transformers/webhooks-transformer.ts
@@ -0,0 +1,90 @@
+import type { Context, Page } from '@/types'
+import type { PageTransformer } from './types'
+import { renderContent } from '@/content-render/index'
+import { fastTextOnly } from '@/content-render/unified/text-only'
+import { loadTemplate } from '@/article-api/lib/load-template'
+import matter from '@gr2m/gray-matter'
+
+/**
+ * Transformer for Webhooks pages.
+ * Converts webhook events and payloads into markdown format using a Liquid template.
+ */
+export class WebhooksTransformer implements PageTransformer {
+ templateName = 'webhooks-page.template.md'
+
+ canTransform(page: Page): boolean {
+ return page.autogenerated === 'webhooks'
+ }
+
+ async transform(page: Page, pathname: string, context: Context): Promise {
+ // Import getInitialPageWebhooks dynamically to avoid circular dependencies
+ const { getInitialPageWebhooks } = await import('@/webhooks/lib/index')
+
+ // Extract version from context
+ const currentVersion = context.currentVersion!
+
+ // Get the webhook data
+ const webhooksData = await getInitialPageWebhooks(currentVersion)
+
+ // Prepare page intro
+ const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
+
+ // Prepare manual content
+ let manualContent = ''
+ if (page.markdown) {
+ const { content } = matter(page.markdown)
+ const markerIndex = content.indexOf(
+ '',
+ )
+
+ if (markerIndex > 0) {
+ const manualMarkdown = content.substring(0, markerIndex).trim()
+ if (manualMarkdown) {
+ manualContent = await renderContent(manualMarkdown, {
+ ...context,
+ markdownRequested: true,
+ })
+ }
+ }
+ }
+
+ // Prepare webhooks data for template
+ const preparedWebhooks = webhooksData.map((webhook) => ({
+ name: webhook.name,
+ actionTypes: webhook.actionTypes,
+ summary: webhook.data.summaryHtml ? fastTextOnly(webhook.data.summaryHtml) : '',
+ description: webhook.data.descriptionHtml ? fastTextOnly(webhook.data.descriptionHtml) : '',
+ availability: webhook.data.availability || [],
+ bodyParameters: (webhook.data.bodyParameters || []).map((param) => ({
+ name: param.name || '',
+ type: param.type || '',
+ description: param.description
+ ? fastTextOnly(param.description).replace(/\n/g, ' ').trim()
+ : '',
+ isRequired: param.isRequired || false,
+ })),
+ payloadExample: webhook.data.payloadExample
+ ? JSON.stringify(webhook.data.payloadExample, null, 2)
+ : null,
+ }))
+
+ // Prepare template data
+ const templateData: Record = {
+ page: {
+ title: page.title,
+ intro,
+ },
+ manualContent,
+ webhooks: preparedWebhooks,
+ }
+
+ // Load and render template
+ const templateContent = loadTemplate(this.templateName)
+
+ return await renderContent(templateContent, {
+ ...context,
+ ...templateData,
+ markdownRequested: true,
+ })
+ }
+}
diff --git a/src/assets/README.md b/src/assets/README.md
index 910b3b244541..d3170b0f63d9 100644
--- a/src/assets/README.md
+++ b/src/assets/README.md
@@ -1,3 +1,70 @@
# Assets
-Assets are files such as images and CSV data that we serve statically to run the docs.github.com application.
+This directory contains the logic for serving, processing, and validating static assets used in the GitHub Docs application. While the actual asset files (images, CSVs, etc.) reside in the root `assets/` directory, `src/assets` houses the code that manages how these assets are delivered to the user.
+
+## Purpose & Scope
+
+The primary responsibilities of this module are:
+- **Dynamic Image Processing**: Converting PNGs to WebP on-the-fly and resizing images based on URL parameters.
+- **Caching Strategy**: Setting appropriate cache headers and surrogate keys for assets, especially those with checksums in their URLs.
+- **Validation & Maintenance**: Scripts to ensure assets are used correctly, identifying orphaned files, and validating image dimensions.
+
+## Architecture
+
+### Middleware
+
+The core logic resides in `src/assets/middleware`:
+
+- **`dynamic-assets.ts`**: Intercepts requests for `/assets/`. It handles:
+ - **WebP Conversion**: If a request ends in `.webp` but the source is a `.png`, it converts the image using `sharp`.
+ - **Resizing**: Supports virtual path segments like `/mw-1000/` to resize images to a maximum width (e.g., 1000px).
+ - **Security**: Validates requested widths against an allowed list (`VALID_MAX_WIDTHS`) to prevent DoS attacks.
+- **`static-asset-caching.ts`**: Detects if an asset URL contains a checksum (e.g., `/assets/cb-12345/...`) and sets aggressive caching headers (`Surrogate-Key: manual-purge`) because the content is immutable.
+
+### Scripts
+
+Located in `src/assets/scripts`, these tools help maintain the asset library:
+- `find-orphaned-assets.ts`: Identifies assets present in the disk but not referenced in the content or code.
+- `validate-asset-images.ts`: Checks for issues like invalid file types or corruption.
+- `list-image-sizes.ts`: Utility for analyzing image dimensions.
+
+### Library
+
+- `src/assets/lib/image-density.ts`: Utilities for handling high-density (Retina) images.
+
+## Setup & Usage
+
+### Adding New Assets
+
+Place static files (images, PDFs, etc.) in the root `assets/` directory.
+- **Images**: `assets/images`
+- **Data**: `assets/` (e.g., CSV files)
+
+### URL Structure
+
+The application (via `src/frame`) often rewrites asset URLs to include a checksum for cache busting.
+- **Source**: `/assets/images/foo.png`
+- **Served**: `/assets/cb-123456/images/foo.png` (The `cb-xxxxx` part is ignored by the file system lookup but used for caching).
+
+### Dynamic Transformations
+
+To request a WebP version of a PNG:
+`GET /assets/images/foo.webp` (Server looks for `foo.png` and converts it).
+
+To request a resized version:
+`GET /assets/mw-1000/images/foo.webp` (Resizes to max-width 1000px).
+
+## Dependencies
+
+- **`sharp`**: Used for high-performance image processing (resizing, format conversion).
+- **`assets/` directory**: The source of truth for static files.
+
+## Ownership
+
+- **Team**: `@github/docs-engineering`
+- **Escalation**: If image serving fails or performance degrades, check the `dynamic-assets` middleware and `sharp` processing.
+
+## Current State & Known Issues
+
+- **On-the-fly Processing**: We currently process images on request (cached by CDN). This avoids a massive build-time step but requires CPU resources on the server for uncached requests.
+- **WebP**: We prefer WebP for performance but maintain PNGs as the source of truth.
\ No newline at end of file
diff --git a/src/assets/middleware/dynamic-assets.ts b/src/assets/middleware/dynamic-assets.ts
index 25ed3fb67c1f..9053151a3181 100644
--- a/src/assets/middleware/dynamic-assets.ts
+++ b/src/assets/middleware/dynamic-assets.ts
@@ -144,7 +144,11 @@ export default async function dynamicAssets(
assetCacheControl(res)
return res.type('image/webp').send(buffer)
} catch (catchError) {
- if (catchError instanceof Error && (catchError as any).code !== 'ENOENT') {
+ if (
+ catchError instanceof Error &&
+ 'code' in catchError &&
+ (catchError as NodeJS.ErrnoException).code !== 'ENOENT'
+ ) {
throw catchError
}
}
diff --git a/src/assets/scripts/find-orphaned-assets.ts b/src/assets/scripts/find-orphaned-assets.ts
index da4fd6d8b5dd..15143e4d7fc2 100755
--- a/src/assets/scripts/find-orphaned-assets.ts
+++ b/src/assets/scripts/find-orphaned-assets.ts
@@ -43,11 +43,42 @@ const EXCEPTIONS = new Set([
'assets/images/site/evergreens/sequoia.png',
'assets/images/site/evergreens/spruce.png',
'assets/images/site/evergreens/yew.png',
+ 'assets/images/social-cards/account-and-profile.png',
'assets/images/social-cards/actions.png',
+ 'assets/images/social-cards/admin.png',
+ 'assets/images/social-cards/apps.png',
+ 'assets/images/social-cards/authentication.png',
+ 'assets/images/social-cards/billing.png',
+ 'assets/images/social-cards/code-security.png',
+ 'assets/images/social-cards/codespaces.png',
+ 'assets/images/social-cards/communities.png',
+ 'assets/images/social-cards/contributing.png',
'assets/images/social-cards/copilot.png',
'assets/images/social-cards/default.png',
+ 'assets/images/social-cards/desktop.png',
+ 'assets/images/social-cards/discussions.png',
+ 'assets/images/social-cards/education.png',
+ 'assets/images/social-cards/enterprise-onboarding.png',
+ 'assets/images/social-cards/get-started.png',
+ 'assets/images/social-cards/github-cli.png',
+ 'assets/images/social-cards/github-models.png',
+ 'assets/images/social-cards/graphql.png',
+ 'assets/images/social-cards/integrations.png',
'assets/images/social-cards/issues.png',
- 'assets/images/social-cards/code-security.png',
+ 'assets/images/social-cards/migrations.png',
+ 'assets/images/social-cards/nonprofit.png',
+ 'assets/images/social-cards/organizations.png',
+ 'assets/images/social-cards/packages.png',
+ 'assets/images/social-cards/pages.png',
+ 'assets/images/social-cards/pull-requests.png',
+ 'assets/images/social-cards/repositories.png',
+ 'assets/images/social-cards/rest.png',
+ 'assets/images/social-cards/search-github.png',
+ 'assets/images/social-cards/site-policy.png',
+ 'assets/images/social-cards/sponsors.png',
+ 'assets/images/social-cards/subscriptions-and-notifications.png',
+ 'assets/images/social-cards/support.png',
+ 'assets/images/social-cards/webhooks.png',
// Hero images may not be used, but we keep them around for future use
'assets/images/banner-images/hero-1.png',
'assets/images/banner-images/hero-2.png',
diff --git a/src/assets/tests/static-assets.ts b/src/assets/tests/static-assets.ts
index 4a1c9ed217e8..b84be4d102f8 100644
--- a/src/assets/tests/static-assets.ts
+++ b/src/assets/tests/static-assets.ts
@@ -3,11 +3,13 @@ import path from 'path'
import { afterAll, beforeAll, describe, expect, test, vi } from 'vitest'
import nock from 'nock'
+import type { Response } from 'express'
import { get } from '@/tests/helpers/e2etest'
import { checkCachingHeaders } from '@/tests/helpers/caching-headers'
import { setDefaultFastlySurrogateKey } from '@/frame/middleware/set-fastly-surrogate-key'
import archivedEnterpriseVersionsAssets from '@/archives/middleware/archived-enterprise-versions-assets'
+import type { ExtendedRequest } from '@/types'
function getNextStaticAsset(directory: string) {
const root = path.join('.next', 'static', directory)
@@ -34,10 +36,10 @@ function mockRequest(requestPath: string, { headers }: { headers?: Record void
- send?: (body: any) => void
+ status: number | undefined
+ statusCode: number | undefined
+ json?: (payload: unknown) => void
+ send?: (body: unknown) => void
sendStatus?: (statusCode: number) => void
end?: () => void
_json?: string
@@ -50,17 +52,17 @@ type MockResponse = {
const mockResponse = () => {
const res: MockResponse = {
- status: undefined as any,
- statusCode: undefined as any,
+ status: undefined,
+ statusCode: undefined,
headers: {},
}
res.json = (payload) => {
- res._json = payload
+ res._json = payload as string
}
res.send = (body) => {
res.status = 200
res.statusCode = 200
- res._send = body
+ res._send = body as string
}
res.end = () => {
// Mock end method
@@ -86,7 +88,7 @@ const mockResponse = () => {
return key in res.headers
}
// Add Express-style status method that supports chaining
- ;(res as any).status = (code: number) => {
+ ;(res as unknown as { status: (code: number) => MockResponse }).status = (code: number) => {
res.status = code
res.statusCode = code
return res
@@ -222,7 +224,11 @@ describe('archived enterprise static assets', () => {
throw new Error('did not expect this to ever happen')
}
setDefaultFastlySurrogateKey(req, res, () => {})
- await archivedEnterpriseVersionsAssets(req as any, res as any, next)
+ await archivedEnterpriseVersionsAssets(
+ req as unknown as ExtendedRequest,
+ res as unknown as Response,
+ next,
+ )
expect(res.statusCode).toBe(200)
checkCachingHeaders(res, false, 60)
})
@@ -238,7 +244,11 @@ describe('archived enterprise static assets', () => {
throw new Error('did not expect this to ever happen')
}
setDefaultFastlySurrogateKey(req, res, () => {})
- await archivedEnterpriseVersionsAssets(req as any, res as any, next)
+ await archivedEnterpriseVersionsAssets(
+ req as unknown as ExtendedRequest,
+ res as unknown as Response,
+ next,
+ )
expect(res.statusCode).toBe(200)
checkCachingHeaders(res, false, 60)
})
@@ -254,7 +264,11 @@ describe('archived enterprise static assets', () => {
throw new Error('did not expect this to ever happen')
}
setDefaultFastlySurrogateKey(req, res, () => {})
- await archivedEnterpriseVersionsAssets(req as any, res as any, next)
+ await archivedEnterpriseVersionsAssets(
+ req as unknown as ExtendedRequest,
+ res as unknown as Response,
+ next,
+ )
expect(res.statusCode).toBe(200)
checkCachingHeaders(res, false, 60)
})
@@ -271,7 +285,11 @@ describe('archived enterprise static assets', () => {
nexted = true
}
setDefaultFastlySurrogateKey(req, res, next)
- await archivedEnterpriseVersionsAssets(req as any, res as any, next)
+ await archivedEnterpriseVersionsAssets(
+ req as unknown as ExtendedRequest,
+ res as unknown as Response,
+ next,
+ )
// It didn't exit in that middleware but called next() to move on
// with any other middlewares.
expect(nexted).toBe(true)
@@ -289,7 +307,11 @@ describe('archived enterprise static assets', () => {
nexted = true
}
setDefaultFastlySurrogateKey(req, res, () => {})
- await archivedEnterpriseVersionsAssets(req as any, res as any, next)
+ await archivedEnterpriseVersionsAssets(
+ req as unknown as ExtendedRequest,
+ res as unknown as Response,
+ next,
+ )
// It tried to go via the proxy, but it wasn't there, but then it
// tried "our disk" and it's eventually there.
expect(nexted).toBe(true)
@@ -335,7 +357,11 @@ describe('archived enterprise static assets', () => {
nexted = true
}
setDefaultFastlySurrogateKey(req, res, () => {})
- await archivedEnterpriseVersionsAssets(req as any, res as any, next)
+ await archivedEnterpriseVersionsAssets(
+ req as unknown as ExtendedRequest,
+ res as unknown as Response,
+ next,
+ )
expect(res.statusCode).toBe(expectStatus)
if (shouldCallNext) {
expect(nexted).toBe(true)
@@ -374,7 +400,11 @@ describe('archived enterprise static assets', () => {
nexted = true
}
setDefaultFastlySurrogateKey(req, res, () => {})
- await archivedEnterpriseVersionsAssets(req as any, res as any, next)
+ await archivedEnterpriseVersionsAssets(
+ req as unknown as ExtendedRequest,
+ res as unknown as Response,
+ next,
+ )
expect(nexted).toBe(shouldCallNext)
expect(res.statusCode).toBe(expectStatus)
})
diff --git a/src/audit-logs/README.md b/src/audit-logs/README.md
index b9320daa1d42..e30b51c3e2b6 100644
--- a/src/audit-logs/README.md
+++ b/src/audit-logs/README.md
@@ -69,3 +69,26 @@ Slack: `#docs-engineering`
Repo: `github/docs-engineering`
If you have a question about the audit log events pipeline, you can ask in the `#docs-engineering` Slack channel. If you notice a problem with the audit log events pipeline, you can open an issue in the `github/docs-engineering` repository.
+
+## Ownership & On-call
+
+### Ownership
+- **Team**: Docs Engineering
+- **Source data**: github/audit-log-allowlists
+
+### On-call procedures
+If the audit log pipeline fails:
+1. Check workflow logs in `.github/workflows/sync-audit-logs.yml`
+2. Verify access to `github/audit-log-allowlists` repo
+3. Check for schema changes in source data
+4. Escalate to #docs-engineering if stuck
+
+### Monitoring
+- Daily workflow runs automatically
+- PRs created with `audit-log-pipeline` label when updates detected
+- Failures visible in GitHub Actions
+
+We are not expecting significant investment here. We will support updates to audit log data as we receive them.
+- Automate version detection
+- Add event usage analytics
+- Create event category visualizations
diff --git a/src/audit-logs/data/fpt/organization.json b/src/audit-logs/data/fpt/organization.json
index 61a4d57994a7..87b056266bce 100644
--- a/src/audit-logs/data/fpt/organization.json
+++ b/src/audit-logs/data/fpt/organization.json
@@ -88,7 +88,7 @@
"created_at",
"_document_id"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
+ "docs_reference_titles": "Editing a repository security advisory"
},
{
"action": "advisory_credit.create",
@@ -246,7 +246,8 @@
"pricing_target_type",
"pricing_target_id",
"budget_limit_type",
- "alert_recipient_user_ids"
+ "alert_recipient_user_ids",
+ "exclude_cost_center_usage"
]
},
{
@@ -519,7 +520,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_fixed",
@@ -537,7 +538,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_outdated",
@@ -554,7 +555,7 @@
"business_id",
"business"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_by_user",
@@ -573,7 +574,7 @@
"alert_numbers",
"dismissal_approver_id"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_approved",
@@ -596,7 +597,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_denied",
@@ -619,7 +620,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_requested",
@@ -642,7 +643,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_created",
@@ -658,7 +659,7 @@
"org",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reappeared",
@@ -676,7 +677,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reopened_by_user",
@@ -694,7 +695,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "codespaces.allow_permissions",
@@ -1318,78 +1319,6 @@
"custom_instructions"
]
},
- {
- "action": "copilot.knowledge_base_created",
- "description": "A knowledge base was created in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
- "fields": [
- "actor",
- "actor_id",
- "user_agent",
- "request_id",
- "knowledge_base_name",
- "org_id",
- "org",
- "action",
- "_document_id",
- "@timestamp",
- "created_at",
- "operation_type",
- "business",
- "business_id",
- "actor_is_bot",
- "request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
- },
- {
- "action": "copilot.knowledge_base_deleted",
- "description": "A knowledge base was deleted from the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
- "fields": [
- "actor",
- "actor_id",
- "user_agent",
- "request_id",
- "knowledge_base_name",
- "org_id",
- "org",
- "action",
- "_document_id",
- "@timestamp",
- "created_at",
- "operation_type",
- "business",
- "business_id",
- "actor_is_bot",
- "request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
- },
- {
- "action": "copilot.knowledge_base_updated",
- "description": "A knowledge base was updated in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
- "fields": [
- "actor",
- "actor_id",
- "user_agent",
- "request_id",
- "knowledge_base_name",
- "org_id",
- "org",
- "action",
- "_document_id",
- "@timestamp",
- "created_at",
- "operation_type",
- "business",
- "business_id",
- "actor_is_bot",
- "request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
- },
{
"action": "copilot.plan_changed",
"description": "The plan for GitHub Copilot was updated.",
@@ -1831,6 +1760,118 @@
],
"docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
},
+ {
+ "action": "dependabot_closure_request.approve",
+ "description": "Dismissal of Dependabot alerts was approved.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.cancel",
+ "description": "Dismissal request for Dependabot alerts was canceled.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.create",
+ "description": "Dismissal of Dependabot alerts was requested.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.deny",
+ "description": "Dismissal of Dependabot alerts was denied.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
{
"action": "dependabot_repository_access.default_access_level_updated",
"description": "The default repository access for Dependabot was updated.",
@@ -2103,96 +2144,6 @@
"request_access_security_header"
]
},
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
- "fields": [
- "request_id",
- "team",
- "created_at",
- "user_id",
- "@timestamp",
- "number",
- "org",
- "title",
- "actor",
- "actor_id",
- "user",
- "action",
- "user_agent",
- "operation_type",
- "_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
- "fields": [
- "actor_id",
- "action",
- "@timestamp",
- "user_agent",
- "operation_type",
- "user_id",
- "actor",
- "number",
- "user",
- "created_at",
- "request_id",
- "_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
- "fields": [
- "action",
- "_document_id",
- "request_id",
- "org",
- "@timestamp",
- "actor_id",
- "operation_type",
- "user",
- "user_id",
- "org_id",
- "user_agent",
- "actor",
- "number",
- "team",
- "created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
- "fields": [
- "created_at",
- "_document_id",
- "title",
- "user",
- "user_agent",
- "org",
- "operation_type",
- "actor_id",
- "@timestamp",
- "actor",
- "team",
- "action",
- "org_id",
- "request_id",
- "user_id",
- "number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
{
"action": "enterprise_announcement.create",
"description": "A global announcement banner was created for the enterprise.",
@@ -3481,6 +3432,57 @@
"programmatic_access_type"
]
},
+ {
+ "action": "issue_comment.pinned",
+ "description": "A comment on an issue was pinned to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_comment.unpinned",
+ "description": "A comment on an issue was unpinned from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
{
"action": "issue_comment.update",
"description": "A comment on an issue (other than the initial one) changed.",
@@ -4480,7 +4482,9 @@
"selected_service",
"network_settings_ids",
"previous_settings_ids",
- "network_configuration_id"
+ "network_configuration_id",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -4524,7 +4528,9 @@
"actor_is_bot",
"selected_service",
"network_settings_ids",
- "previous_settings_ids"
+ "previous_settings_ids",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -5010,12 +5016,12 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "Limiting OAuth app and GitHub App access requests and installations"
},
{
"action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
"description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
"fields": [
"actor",
"actor_id",
@@ -5029,7 +5035,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests"
},
{
"action": "org.archive",
@@ -5355,7 +5361,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -5378,7 +5384,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codespaces_access_updated",
@@ -11749,7 +11755,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -11777,7 +11783,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -11805,7 +11811,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codespaces_trusted_repo_access_granted",
@@ -13243,7 +13249,7 @@
"org_id",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
+ "docs_reference_titles": "About repository security advisories"
},
{
"action": "repository_advisory.cve_request",
@@ -13589,6 +13595,56 @@
"actor_is_bot"
]
},
+ {
+ "action": "repository_dependency_updates_self_hosted.disabled",
+ "description": "Dependency updates on self-hosted runners was disabled.",
+ "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Configuring Dependabot on self-hosted runners"
+ },
+ {
+ "action": "repository_dependency_updates_self_hosted.enabled",
+ "description": "Dependency updates on self-hosted runners was enabled.",
+ "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners",
+ "fields": [
+ "topic",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "Configuring Dependabot on self-hosted runners"
+ },
{
"action": "repository_image.create",
"description": "An image to represent a repository was uploaded.",
@@ -14190,6 +14246,34 @@
"programmatic_access_type"
]
},
+ {
+ "action": "repository_secret_scanning_extended_metadata.disabled",
+ "description": "Metadata for secret scanning alerts has been disabled at the repository level",
+ "docs_reference_links": "/code-security/secret-scanning/enabling-secret-scanning-features/enabling-extended-metadata-checks-for-your-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Enabling extended metadata checks for your repository"
+ },
{
"action": "repository_secret_scanning_generic_secrets.disabled",
"description": "Generic secrets have been disabled at the repository level",
@@ -14556,6 +14640,60 @@
"request_access_security_header"
]
},
+ {
+ "action": "repository_security_updates.disable",
+ "description": "Dependabot security updates was disabled.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Configuring Dependabot security updates"
+ },
+ {
+ "action": "repository_security_updates.enable",
+ "description": "Dependabot security updates was enabled.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "Configuring Dependabot security updates"
+ },
{
"action": "repository_visibility_change.clear",
"description": "The repository visibility change setting was cleared for an organization or enterprise.",
@@ -14700,7 +14838,7 @@
"alert_number",
"programmatic_access_type"
],
- "docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+ "docs_reference_titles": "About Dependabot alerts"
},
{
"action": "repository_vulnerability_alert.dismiss",
@@ -15135,7 +15273,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.create",
@@ -15156,7 +15294,30 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning_alert.delete",
+ "description": "A secret scanning alert was deleted by GitHub.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "created_at",
+ "reason"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.public_leak",
@@ -15178,7 +15339,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -15224,7 +15385,7 @@
"secret_type_provider",
"report_result"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts"
+ "docs_reference_titles": "Resolving alerts from secret scanning"
},
{
"action": "secret_scanning_alert.resolve",
@@ -15301,7 +15462,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.validate",
@@ -15325,7 +15486,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_closure_request.approve",
@@ -15603,7 +15764,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_push_protection_request.complete",
@@ -15630,7 +15791,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_push_protection_request.deny",
@@ -15685,7 +15846,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_scan.completed",
@@ -15756,7 +15917,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15846,7 +16008,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15907,7 +16070,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -16417,7 +16581,7 @@
},
{
"action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
+ "description": "Dependabot encrypted config was read.",
"docs_reference_links": "N/A",
"fields": [
"user_agent",
@@ -16769,67 +16933,6 @@
"team_type"
]
},
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "business_id",
- "operation_type",
- "@timestamp",
- "user_agent",
- "actor",
- "actor_id",
- "user",
- "business",
- "action",
- "request_id",
- "created_at",
- "user_id",
- "_document_id"
- ]
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
- "fields": [
- "org_id",
- "action",
- "operation_type",
- "request_id",
- "actor",
- "org",
- "created_at",
- "actor_id",
- "user",
- "user_id",
- "@timestamp",
- "user_agent",
- "_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "actor_id",
- "@timestamp",
- "action",
- "_document_id",
- "user_agent",
- "user_id",
- "business_id",
- "request_id",
- "user",
- "business",
- "operation_type",
- "actor",
- "created_at"
- ]
- },
{
"action": "team_group_mapping.create",
"description": "N/A",
diff --git a/src/audit-logs/data/fpt/user.json b/src/audit-logs/data/fpt/user.json
index 97af53a1b41b..d12883c8b51a 100644
--- a/src/audit-logs/data/fpt/user.json
+++ b/src/audit-logs/data/fpt/user.json
@@ -169,7 +169,8 @@
"pricing_target_type",
"pricing_target_id",
"budget_limit_type",
- "alert_recipient_user_ids"
+ "alert_recipient_user_ids",
+ "exclude_cost_center_usage"
]
},
{
@@ -1295,6 +1296,118 @@
],
"docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
},
+ {
+ "action": "dependabot_closure_request.approve",
+ "description": "Dismissal of Dependabot alerts was approved.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.cancel",
+ "description": "Dismissal request for Dependabot alerts was canceled.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.create",
+ "description": "Dismissal of Dependabot alerts was requested.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.deny",
+ "description": "Dismissal of Dependabot alerts was denied.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
{
"action": "dependabot_repository_access.repositories_updated",
"description": "The repositories that Dependabot can access were updated.",
diff --git a/src/audit-logs/data/ghec/enterprise.json b/src/audit-logs/data/ghec/enterprise.json
index 2fcd3add37df..c97a1bf551dc 100644
--- a/src/audit-logs/data/ghec/enterprise.json
+++ b/src/audit-logs/data/ghec/enterprise.json
@@ -88,7 +88,7 @@
"created_at",
"_document_id"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
+ "docs_reference_titles": "Editing a repository security advisory"
},
{
"action": "advisory_credit.create",
@@ -378,7 +378,8 @@
"pricing_target_type",
"pricing_target_id",
"budget_limit_type",
- "alert_recipient_user_ids"
+ "alert_recipient_user_ids",
+ "exclude_cost_center_usage"
]
},
{
@@ -1791,7 +1792,7 @@
},
{
"action": "business.invite_billing_manager",
- "description": "An invitation for someone to be an billing manager of an enterprise was sent.",
+ "description": "An invitation for someone to be a billing manager of an enterprise was sent.",
"docs_reference_links": "N/A",
"fields": [
"user",
@@ -1811,6 +1812,29 @@
"created_at"
]
},
+ {
+ "action": "business.invite_unaffiliated_member",
+ "description": "An invitation for someone to join an enterprise was sent.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "name",
+ "invitation_id",
+ "email",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
{
"action": "business.members_can_update_protected_branches.clear",
"description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
@@ -1874,6 +1898,52 @@
"user_id"
]
},
+ {
+ "action": "business.members_limit_reached",
+ "description": "An enterprise has reached its members limit.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "name",
+ "limit",
+ "count",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "business.organizations_limit_warning",
+ "description": "An enterprise is approaching its organizations limit.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "name",
+ "limit",
+ "count",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
{
"action": "business.proxy_security_header_disabled",
"description": "The proxy security header was disabled for an enterprise. All users on the network can now access GitHub, unless blocked by other means.",
@@ -3393,7 +3463,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_fixed",
@@ -3411,7 +3481,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_outdated",
@@ -3428,7 +3498,7 @@
"business_id",
"business"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_by_user",
@@ -3447,7 +3517,7 @@
"alert_numbers",
"dismissal_approver_id"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_approved",
@@ -3470,7 +3540,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_denied",
@@ -3493,7 +3563,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_requested",
@@ -3516,7 +3586,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_created",
@@ -3532,7 +3602,7 @@
"org",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reappeared",
@@ -3550,7 +3620,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reopened_by_user",
@@ -3568,24 +3638,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
- },
- {
- "action": "code.search",
- "description": "A code search was run targeting an organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/search-github/github-code-search",
- "fields": [
- "@timestamp",
- "action",
- "actor_id",
- "business_id",
- "query",
- "org_id",
- "user_id",
- "_document_id",
- "search_string"
- ],
- "docs_reference_titles": "/search-github/github-code-search"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "codespaces.allow_permissions",
@@ -4250,78 +4303,6 @@
"operation_type"
]
},
- {
- "action": "copilot.knowledge_base_created",
- "description": "A knowledge base was created in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
- "fields": [
- "actor",
- "actor_id",
- "user_agent",
- "request_id",
- "knowledge_base_name",
- "org_id",
- "org",
- "action",
- "_document_id",
- "@timestamp",
- "created_at",
- "operation_type",
- "business",
- "business_id",
- "actor_is_bot",
- "request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
- },
- {
- "action": "copilot.knowledge_base_deleted",
- "description": "A knowledge base was deleted from the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
- "fields": [
- "actor",
- "actor_id",
- "user_agent",
- "request_id",
- "knowledge_base_name",
- "org_id",
- "org",
- "action",
- "_document_id",
- "@timestamp",
- "created_at",
- "operation_type",
- "business",
- "business_id",
- "actor_is_bot",
- "request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
- },
- {
- "action": "copilot.knowledge_base_updated",
- "description": "A knowledge base was updated in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
- "fields": [
- "actor",
- "actor_id",
- "user_agent",
- "request_id",
- "knowledge_base_name",
- "org_id",
- "org",
- "action",
- "_document_id",
- "@timestamp",
- "created_at",
- "operation_type",
- "business",
- "business_id",
- "actor_is_bot",
- "request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
- },
{
"action": "copilot.plan_changed",
"description": "The plan for GitHub Copilot was updated.",
@@ -4672,6 +4653,118 @@
],
"docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
},
+ {
+ "action": "dependabot_closure_request.approve",
+ "description": "Dismissal of Dependabot alerts was approved.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.cancel",
+ "description": "Dismissal request for Dependabot alerts was canceled.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.create",
+ "description": "Dismissal of Dependabot alerts was requested.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.deny",
+ "description": "Dismissal of Dependabot alerts was denied.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
{
"action": "dependabot_repository_access.default_access_level_updated",
"description": "The default repository access for Dependabot was updated.",
@@ -4944,96 +5037,6 @@
"request_access_security_header"
]
},
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
- "fields": [
- "request_id",
- "team",
- "created_at",
- "user_id",
- "@timestamp",
- "number",
- "org",
- "title",
- "actor",
- "actor_id",
- "user",
- "action",
- "user_agent",
- "operation_type",
- "_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
- "fields": [
- "actor_id",
- "action",
- "@timestamp",
- "user_agent",
- "operation_type",
- "user_id",
- "actor",
- "number",
- "user",
- "created_at",
- "request_id",
- "_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
- "fields": [
- "action",
- "_document_id",
- "request_id",
- "org",
- "@timestamp",
- "actor_id",
- "operation_type",
- "user",
- "user_id",
- "org_id",
- "user_agent",
- "actor",
- "number",
- "team",
- "created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
- "fields": [
- "created_at",
- "_document_id",
- "title",
- "user",
- "user_agent",
- "org",
- "operation_type",
- "actor_id",
- "@timestamp",
- "actor",
- "team",
- "action",
- "org_id",
- "request_id",
- "user_id",
- "number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
{
"action": "enterprise_announcement.create",
"description": "A global announcement banner was created for the enterprise.",
@@ -7456,30 +7459,81 @@
"_document_id",
"@timestamp",
"created_at",
- "operation_type"
+ "operation_type"
+ ]
+ },
+ {
+ "action": "issue_comment.destroy",
+ "description": "A comment on an issue was deleted from the repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "org",
+ "repo",
+ "actor_id",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "action",
+ "operation_type",
+ "user_agent",
+ "repo_id",
+ "actor",
+ "request_id",
+ "oauth_application_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "issue_comment.pinned",
+ "description": "A comment on an issue was pinned to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
]
},
{
- "action": "issue_comment.destroy",
- "description": "A comment on an issue was deleted from the repository.",
+ "action": "issue_comment.unpinned",
+ "description": "A comment on an issue was unpinned from a repository.",
"docs_reference_links": "N/A",
"fields": [
- "org_id",
- "org",
- "repo",
+ "actor",
"actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
"@timestamp",
"created_at",
- "_document_id",
- "action",
"operation_type",
- "user_agent",
- "repo_id",
- "actor",
- "request_id",
- "oauth_application_id",
- "token_scopes",
- "programmatic_access_type"
+ "actor_is_bot"
]
},
{
@@ -8264,7 +8318,9 @@
"selected_service",
"network_settings_ids",
"previous_settings_ids",
- "network_configuration_id"
+ "network_configuration_id",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -8308,7 +8364,9 @@
"actor_is_bot",
"selected_service",
"network_settings_ids",
- "previous_settings_ids"
+ "previous_settings_ids",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -9014,7 +9072,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -9037,7 +9095,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codespaces_access_updated",
@@ -15184,7 +15242,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -15212,7 +15270,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -15240,7 +15298,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codespaces_trusted_repo_access_granted",
@@ -16702,7 +16760,7 @@
"org_id",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
+ "docs_reference_titles": "About repository security advisories"
},
{
"action": "repository_advisory.cve_request",
@@ -17048,6 +17106,56 @@
"actor_is_bot"
]
},
+ {
+ "action": "repository_dependency_updates_self_hosted.disabled",
+ "description": "Dependency updates on self-hosted runners was disabled.",
+ "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Configuring Dependabot on self-hosted runners"
+ },
+ {
+ "action": "repository_dependency_updates_self_hosted.enabled",
+ "description": "Dependency updates on self-hosted runners was enabled.",
+ "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners",
+ "fields": [
+ "topic",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "Configuring Dependabot on self-hosted runners"
+ },
{
"action": "repository_image.create",
"description": "An image to represent a repository was uploaded.",
@@ -17607,6 +17715,34 @@
"programmatic_access_type"
]
},
+ {
+ "action": "repository_secret_scanning_extended_metadata.disabled",
+ "description": "Metadata for secret scanning alerts has been disabled at the repository level",
+ "docs_reference_links": "/code-security/secret-scanning/enabling-secret-scanning-features/enabling-extended-metadata-checks-for-your-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Enabling extended metadata checks for your repository"
+ },
{
"action": "repository_secret_scanning_generic_secrets.disabled",
"description": "Generic secrets have been disabled at the repository level",
@@ -17973,6 +18109,60 @@
"request_access_security_header"
]
},
+ {
+ "action": "repository_security_updates.disable",
+ "description": "Dependabot security updates was disabled.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Configuring Dependabot security updates"
+ },
+ {
+ "action": "repository_security_updates.enable",
+ "description": "Dependabot security updates was enabled.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "Configuring Dependabot security updates"
+ },
{
"action": "repository_visibility_change.clear",
"description": "The repository visibility change setting was cleared for an organization or enterprise.",
@@ -18117,7 +18307,7 @@
"alert_number",
"programmatic_access_type"
],
- "docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+ "docs_reference_titles": "About Dependabot alerts"
},
{
"action": "repository_vulnerability_alert.dismiss",
@@ -18552,7 +18742,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.create",
@@ -18573,7 +18763,30 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning_alert.delete",
+ "description": "A secret scanning alert was deleted by GitHub.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "created_at",
+ "reason"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.public_leak",
@@ -18595,7 +18808,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -18641,7 +18854,7 @@
"secret_type_provider",
"report_result"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts"
+ "docs_reference_titles": "Resolving alerts from secret scanning"
},
{
"action": "secret_scanning_alert.resolve",
@@ -18718,7 +18931,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.validate",
@@ -18742,7 +18955,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_closure_request.approve",
@@ -19020,7 +19233,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_push_protection_request.complete",
@@ -19047,7 +19260,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_push_protection_request.deny",
@@ -19102,7 +19315,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_scan.completed",
@@ -19173,7 +19386,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -19263,7 +19477,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -19324,7 +19539,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -19813,6 +20029,46 @@
],
"docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
},
+ {
+ "action": "sso_lockdown.disable",
+ "description": "SSO lockdown for users was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "sso_lockdown.enable",
+ "description": "SSO lockdown for users was enabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
{
"action": "sso_redirect.disable",
"description": "Automatic redirects for users to single sign-on (SSO) was disabled.",
@@ -20088,67 +20344,6 @@
"team_type"
]
},
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "business_id",
- "operation_type",
- "@timestamp",
- "user_agent",
- "actor",
- "actor_id",
- "user",
- "business",
- "action",
- "request_id",
- "created_at",
- "user_id",
- "_document_id"
- ]
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
- "fields": [
- "org_id",
- "action",
- "operation_type",
- "request_id",
- "actor",
- "org",
- "created_at",
- "actor_id",
- "user",
- "user_id",
- "@timestamp",
- "user_agent",
- "_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "actor_id",
- "@timestamp",
- "action",
- "_document_id",
- "user_agent",
- "user_id",
- "business_id",
- "request_id",
- "user",
- "business",
- "operation_type",
- "actor",
- "created_at"
- ]
- },
{
"action": "team.promote_maintainer",
"description": "A user was promoted from a team member to a team maintainer.",
diff --git a/src/audit-logs/data/ghec/organization.json b/src/audit-logs/data/ghec/organization.json
index 61a4d57994a7..87b056266bce 100644
--- a/src/audit-logs/data/ghec/organization.json
+++ b/src/audit-logs/data/ghec/organization.json
@@ -88,7 +88,7 @@
"created_at",
"_document_id"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
+ "docs_reference_titles": "Editing a repository security advisory"
},
{
"action": "advisory_credit.create",
@@ -246,7 +246,8 @@
"pricing_target_type",
"pricing_target_id",
"budget_limit_type",
- "alert_recipient_user_ids"
+ "alert_recipient_user_ids",
+ "exclude_cost_center_usage"
]
},
{
@@ -519,7 +520,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_fixed",
@@ -537,7 +538,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_outdated",
@@ -554,7 +555,7 @@
"business_id",
"business"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_by_user",
@@ -573,7 +574,7 @@
"alert_numbers",
"dismissal_approver_id"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_approved",
@@ -596,7 +597,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_denied",
@@ -619,7 +620,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_requested",
@@ -642,7 +643,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_created",
@@ -658,7 +659,7 @@
"org",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reappeared",
@@ -676,7 +677,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reopened_by_user",
@@ -694,7 +695,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "codespaces.allow_permissions",
@@ -1318,78 +1319,6 @@
"custom_instructions"
]
},
- {
- "action": "copilot.knowledge_base_created",
- "description": "A knowledge base was created in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
- "fields": [
- "actor",
- "actor_id",
- "user_agent",
- "request_id",
- "knowledge_base_name",
- "org_id",
- "org",
- "action",
- "_document_id",
- "@timestamp",
- "created_at",
- "operation_type",
- "business",
- "business_id",
- "actor_is_bot",
- "request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
- },
- {
- "action": "copilot.knowledge_base_deleted",
- "description": "A knowledge base was deleted from the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
- "fields": [
- "actor",
- "actor_id",
- "user_agent",
- "request_id",
- "knowledge_base_name",
- "org_id",
- "org",
- "action",
- "_document_id",
- "@timestamp",
- "created_at",
- "operation_type",
- "business",
- "business_id",
- "actor_is_bot",
- "request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
- },
- {
- "action": "copilot.knowledge_base_updated",
- "description": "A knowledge base was updated in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
- "fields": [
- "actor",
- "actor_id",
- "user_agent",
- "request_id",
- "knowledge_base_name",
- "org_id",
- "org",
- "action",
- "_document_id",
- "@timestamp",
- "created_at",
- "operation_type",
- "business",
- "business_id",
- "actor_is_bot",
- "request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
- },
{
"action": "copilot.plan_changed",
"description": "The plan for GitHub Copilot was updated.",
@@ -1831,6 +1760,118 @@
],
"docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
},
+ {
+ "action": "dependabot_closure_request.approve",
+ "description": "Dismissal of Dependabot alerts was approved.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.cancel",
+ "description": "Dismissal request for Dependabot alerts was canceled.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.create",
+ "description": "Dismissal of Dependabot alerts was requested.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.deny",
+ "description": "Dismissal of Dependabot alerts was denied.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
{
"action": "dependabot_repository_access.default_access_level_updated",
"description": "The default repository access for Dependabot was updated.",
@@ -2103,96 +2144,6 @@
"request_access_security_header"
]
},
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
- "fields": [
- "request_id",
- "team",
- "created_at",
- "user_id",
- "@timestamp",
- "number",
- "org",
- "title",
- "actor",
- "actor_id",
- "user",
- "action",
- "user_agent",
- "operation_type",
- "_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
- "fields": [
- "actor_id",
- "action",
- "@timestamp",
- "user_agent",
- "operation_type",
- "user_id",
- "actor",
- "number",
- "user",
- "created_at",
- "request_id",
- "_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
- "fields": [
- "action",
- "_document_id",
- "request_id",
- "org",
- "@timestamp",
- "actor_id",
- "operation_type",
- "user",
- "user_id",
- "org_id",
- "user_agent",
- "actor",
- "number",
- "team",
- "created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
- "fields": [
- "created_at",
- "_document_id",
- "title",
- "user",
- "user_agent",
- "org",
- "operation_type",
- "actor_id",
- "@timestamp",
- "actor",
- "team",
- "action",
- "org_id",
- "request_id",
- "user_id",
- "number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
{
"action": "enterprise_announcement.create",
"description": "A global announcement banner was created for the enterprise.",
@@ -3481,6 +3432,57 @@
"programmatic_access_type"
]
},
+ {
+ "action": "issue_comment.pinned",
+ "description": "A comment on an issue was pinned to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_comment.unpinned",
+ "description": "A comment on an issue was unpinned from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
{
"action": "issue_comment.update",
"description": "A comment on an issue (other than the initial one) changed.",
@@ -4480,7 +4482,9 @@
"selected_service",
"network_settings_ids",
"previous_settings_ids",
- "network_configuration_id"
+ "network_configuration_id",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -4524,7 +4528,9 @@
"actor_is_bot",
"selected_service",
"network_settings_ids",
- "previous_settings_ids"
+ "previous_settings_ids",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -5010,12 +5016,12 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "Limiting OAuth app and GitHub App access requests and installations"
},
{
"action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
"description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
"fields": [
"actor",
"actor_id",
@@ -5029,7 +5035,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests"
},
{
"action": "org.archive",
@@ -5355,7 +5361,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -5378,7 +5384,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codespaces_access_updated",
@@ -11749,7 +11755,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -11777,7 +11783,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -11805,7 +11811,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codespaces_trusted_repo_access_granted",
@@ -13243,7 +13249,7 @@
"org_id",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
+ "docs_reference_titles": "About repository security advisories"
},
{
"action": "repository_advisory.cve_request",
@@ -13589,6 +13595,56 @@
"actor_is_bot"
]
},
+ {
+ "action": "repository_dependency_updates_self_hosted.disabled",
+ "description": "Dependency updates on self-hosted runners was disabled.",
+ "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Configuring Dependabot on self-hosted runners"
+ },
+ {
+ "action": "repository_dependency_updates_self_hosted.enabled",
+ "description": "Dependency updates on self-hosted runners was enabled.",
+ "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners",
+ "fields": [
+ "topic",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "Configuring Dependabot on self-hosted runners"
+ },
{
"action": "repository_image.create",
"description": "An image to represent a repository was uploaded.",
@@ -14190,6 +14246,34 @@
"programmatic_access_type"
]
},
+ {
+ "action": "repository_secret_scanning_extended_metadata.disabled",
+ "description": "Metadata for secret scanning alerts has been disabled at the repository level",
+ "docs_reference_links": "/code-security/secret-scanning/enabling-secret-scanning-features/enabling-extended-metadata-checks-for-your-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Enabling extended metadata checks for your repository"
+ },
{
"action": "repository_secret_scanning_generic_secrets.disabled",
"description": "Generic secrets have been disabled at the repository level",
@@ -14556,6 +14640,60 @@
"request_access_security_header"
]
},
+ {
+ "action": "repository_security_updates.disable",
+ "description": "Dependabot security updates was disabled.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Configuring Dependabot security updates"
+ },
+ {
+ "action": "repository_security_updates.enable",
+ "description": "Dependabot security updates was enabled.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "Configuring Dependabot security updates"
+ },
{
"action": "repository_visibility_change.clear",
"description": "The repository visibility change setting was cleared for an organization or enterprise.",
@@ -14700,7 +14838,7 @@
"alert_number",
"programmatic_access_type"
],
- "docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+ "docs_reference_titles": "About Dependabot alerts"
},
{
"action": "repository_vulnerability_alert.dismiss",
@@ -15135,7 +15273,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.create",
@@ -15156,7 +15294,30 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning_alert.delete",
+ "description": "A secret scanning alert was deleted by GitHub.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "created_at",
+ "reason"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.public_leak",
@@ -15178,7 +15339,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -15224,7 +15385,7 @@
"secret_type_provider",
"report_result"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts"
+ "docs_reference_titles": "Resolving alerts from secret scanning"
},
{
"action": "secret_scanning_alert.resolve",
@@ -15301,7 +15462,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.validate",
@@ -15325,7 +15486,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_closure_request.approve",
@@ -15603,7 +15764,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_push_protection_request.complete",
@@ -15630,7 +15791,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_push_protection_request.deny",
@@ -15685,7 +15846,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_scan.completed",
@@ -15756,7 +15917,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15846,7 +16008,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15907,7 +16070,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -16417,7 +16581,7 @@
},
{
"action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
+ "description": "Dependabot encrypted config was read.",
"docs_reference_links": "N/A",
"fields": [
"user_agent",
@@ -16769,67 +16933,6 @@
"team_type"
]
},
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "business_id",
- "operation_type",
- "@timestamp",
- "user_agent",
- "actor",
- "actor_id",
- "user",
- "business",
- "action",
- "request_id",
- "created_at",
- "user_id",
- "_document_id"
- ]
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
- "fields": [
- "org_id",
- "action",
- "operation_type",
- "request_id",
- "actor",
- "org",
- "created_at",
- "actor_id",
- "user",
- "user_id",
- "@timestamp",
- "user_agent",
- "_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "actor_id",
- "@timestamp",
- "action",
- "_document_id",
- "user_agent",
- "user_id",
- "business_id",
- "request_id",
- "user",
- "business",
- "operation_type",
- "actor",
- "created_at"
- ]
- },
{
"action": "team_group_mapping.create",
"description": "N/A",
diff --git a/src/audit-logs/data/ghec/user.json b/src/audit-logs/data/ghec/user.json
index 97af53a1b41b..d12883c8b51a 100644
--- a/src/audit-logs/data/ghec/user.json
+++ b/src/audit-logs/data/ghec/user.json
@@ -169,7 +169,8 @@
"pricing_target_type",
"pricing_target_id",
"budget_limit_type",
- "alert_recipient_user_ids"
+ "alert_recipient_user_ids",
+ "exclude_cost_center_usage"
]
},
{
@@ -1295,6 +1296,118 @@
],
"docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
},
+ {
+ "action": "dependabot_closure_request.approve",
+ "description": "Dismissal of Dependabot alerts was approved.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.cancel",
+ "description": "Dismissal request for Dependabot alerts was canceled.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.create",
+ "description": "Dismissal of Dependabot alerts was requested.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "dependabot_closure_request.deny",
+ "description": "Dismissal of Dependabot alerts was denied.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
{
"action": "dependabot_repository_access.repositories_updated",
"description": "The repositories that Dependabot can access were updated.",
diff --git a/src/audit-logs/data/ghes-3.10/enterprise.json b/src/audit-logs/data/ghes-3.10/enterprise.json
deleted file mode 100644
index f71834bce75b..000000000000
--- a/src/audit-logs/data/ghes-3.10/enterprise.json
+++ /dev/null
@@ -1,3242 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "account_recovery_token.confirm",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.recover",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "api.request",
- "description": "An API request was made to a security-significant endpoint for the enterprise. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.check",
- "description": "A manual check of the endpoint configured for audit log streaming was performed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.create",
- "description": "An endpoint was added for audit log streaming.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.destroy",
- "description": "An audit log streaming endpoint was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.update",
- "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.update_bill_cycle_day",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.add_admin",
- "description": "An enterprise owner was added to an enterprise.",
- "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise"
- },
- {
- "action": "business.add_organization",
- "description": "An organization was added to an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_advanced_security.disabled",
- "description": "GitHub Advanced Security was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.enabled",
- "description": "GitHub Advanced Security was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business.advanced_security_policy_update",
- "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise"
- },
- {
- "action": "business.advanced_security_repo_admin_enablement_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.clear_actions_settings",
- "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise"
- },
- {
- "action": "business.clear_default_repository_permission",
- "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions"
- },
- {
- "action": "business.clear_members_can_create_repos",
- "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation"
- },
- {
- "action": "business.create",
- "description": "An enterprise was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.dependabot_alerts_repo_admin_enablement_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.disable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise"
- },
- {
- "action": "business.disable_two_factor_requirement",
- "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.enable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise"
- },
- {
- "action": "business.enable_two_factor_requirement",
- "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.clear",
- "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.remove_admin",
- "description": "An enterprise owner was removed from an enterprise.",
- "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise"
- },
- {
- "action": "business.remove_organization",
- "description": "An organization was removed from an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.rename_slug",
- "description": "The slug for the enterprise URL was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_custom_pattern.create",
- "description": "An enterprise-level custom pattern was created for secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern.delete",
- "description": "An enterprise-level custom pattern was removed from secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_custom_pattern.publish",
- "description": "An enterprise-level custom pattern was published for secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern.update",
- "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning.disable",
- "description": "Secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.disabled_for_new_repos",
- "description": "Secret scanning was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.enable",
- "description": "Secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.enabled_for_new_repos",
- "description": "Secret scanning was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.disable",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.enable",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.update",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.disable",
- "description": "Push protection for secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.disabled_for_new_repos",
- "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.enable",
- "description": "Push protection for secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.enabled_for_new_repos",
- "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business.secret_scanning_repo_admin_settings_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.set_actions_fork_pr_approvals_policy",
- "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories"
- },
- {
- "action": "business.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise"
- },
- {
- "action": "business.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise"
- },
- {
- "action": "business.set_fork_pr_workflows_policy",
- "description": "The policy for fork pull request workflows was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "business.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.update_actions_settings",
- "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise"
- },
- {
- "action": "business.update_default_repository_permission",
- "description": "The base repository permission setting was updated for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions"
- },
- {
- "action": "business.update_member_repository_creation_permission",
- "description": "The repository creation setting was updated for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation"
- },
- {
- "action": "business.update_member_repository_invitation_permission",
- "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "enterprise_announcement.create",
- "description": "A global announcement banner was created for the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner"
- },
- {
- "action": "enterprise_announcement.destroy",
- "description": "A global announcement banner was removed from the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise"
- },
- {
- "action": "enterprise_announcement.update",
- "description": "A global announcement banner was updated for the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise"
- },
- {
- "action": "enterprise.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "enterprise_domain.approve",
- "description": "A domain was approved for an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise_domain.create",
- "description": "A domain was added to an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise_domain.destroy",
- "description": "A domain was removed from an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain"
- },
- {
- "action": "enterprise_domain.verify",
- "description": "A domain was verified for an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise.register_self_hosted_runner",
- "description": "A new GitHub Actions self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "enterprise.remove_self_hosted_runner",
- "description": "A GitHub Actions self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "enterprise.runner_group_created",
- "description": "A GitHub Actions self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "enterprise.runner_group_removed",
- "description": "A GitHub Actions self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "enterprise.runner_group_runner_removed",
- "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "enterprise.runner_group_runners_added",
- "description": "A GitHub Actions self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "enterprise.runner_group_runners_updated",
- "description": "A GitHub Actions runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "enterprise.runner_group_updated",
- "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "enterprise.self_hosted_runner_offline",
- "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "enterprise.self_hosted_runner_online",
- "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "enterprise.self_hosted_runner_updated",
- "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "git.clone",
- "description": "A repository was cloned.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.fetch",
- "description": "Changes were fetched from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.push",
- "description": "Changes were pushed to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git_signing_ssh_public_key.create",
- "description": "An SSH key was added to a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "git_signing_ssh_public_key.delete",
- "description": "An SSH key was removed from a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "ip_allow_list.disable",
- "description": "An IP allow list was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_for_installed_apps",
- "description": "An IP allow list was disabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_user_level_enforcement",
- "description": "IP allow list user level enforcement was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable",
- "description": "An IP allow list was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_for_installed_apps",
- "description": "An IP allow list was enabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_user_level_enforcement",
- "description": "IP allow list user level enforcement was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.create",
- "description": "An IP address was added to an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.destroy",
- "description": "An IP address was deleted from an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.update",
- "description": "An IP address or its description was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.publish",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.retire",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.create",
- "description": "An OAuth access token was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token"
- },
- {
- "action": "oauth_access.destroy",
- "description": "An OAuth access token was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_access.regenerate",
- "description": "An OAuth access token was regenerated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.update",
- "description": "An OAuth access token was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.suspend",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.unsuspend",
- "description": "An OAuth application was unsuspended for a user or organization account.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_authorization.create",
- "description": "An authorization for an OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_authorization.destroy",
- "description": "An authorization for an OAuth application was deleted.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations"
- },
- {
- "action": "oauth_authorization.update",
- "description": "An authorization for an OAuth application was updated.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "org.accept_business_invitation",
- "description": "An invitation sent to an organization to join an enterprise was accepted.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.add_billing_manager",
- "description": "A billing manager was added to an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_policy_selected_member_disabled",
- "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.advanced_security_policy_selected_member_enabled",
- "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.async_delete",
- "description": "A user initiated a background job to delete an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.audit_log_export",
- "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
- },
- {
- "action": "org.billing_signup_error",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.block_user",
- "description": "An organization owner blocked a user from accessing the organization's repositories.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
- },
- {
- "action": "org.cancel_business_invitation",
- "description": "An invitation for an organization to join an enterprise was revoked",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.cancel_invitation",
- "description": "An invitation sent to a user to join an organization was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.clear_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.confirm_business_invitation",
- "description": "An invitation for an organization to join an enterprise was confirmed.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.create",
- "description": "An organization was created.",
- "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
- },
- {
- "action": "org.delete",
- "description": "An organization was deleted by a user or staff.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_member_team_creation_permission",
- "description": "Team creation was limited to owners.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.disable_reader_discussion_creation_permission",
- "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.disable_saml",
- "description": "SAML single sign-on was disabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_two_factor_requirement",
- "description": "A two-factor authentication requirement was disabled for the organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_disabled",
- "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_enabled",
- "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.enable_member_team_creation_permission",
- "description": "Team creation by members was allowed.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.enable_reader_discussion_creation_permission",
- "description": "An organization owner allowed users with read access to create discussions in an organization",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.enable_saml",
- "description": "SAML single sign-on was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization"
- },
- {
- "action": "org.enable_two_factor_requirement",
- "description": "Two-factor authentication is now required for the organization.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.integration_manager_added",
- "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.integration_manager_removed",
- "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.invite_member",
- "description": "A new user was invited to join an organization.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
- },
- {
- "action": "org.invite_to_business",
- "description": "An organization was invited to join an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.rate_limited_invites",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.recreate",
- "description": "An organization was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization"
- },
- {
- "action": "org.remove_billing_manager",
- "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_outside_collaborator",
- "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization"
- },
- {
- "action": "org.rename",
- "description": "An organization was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.restore_member",
- "description": "An organization member was restored.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
- },
- {
- "action": "org.runner_group_created",
- "description": "A self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org.runner_group_removed",
- "description": "A self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_runner_removed",
- "description": "The REST API was used to remove a self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_runners_added",
- "description": "A self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "org.runner_group_runners_updated",
- "description": "A runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_updated",
- "description": "The configuration of a self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "org_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_disabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_enabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_updated",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_disable",
- "description": "Push protection for secret scanning was disabled.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "org.secret_scanning_push_protection_enable",
- "description": "Push protection for secret scanning was enabled.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_disable",
- "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_enable",
- "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.transform",
- "description": "A user account was converted into an organization.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization"
- },
- {
- "action": "org.unblock_user",
- "description": "A user was unblocked from an organization.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
- },
- {
- "action": "org.update_actions_settings",
- "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
- },
- {
- "action": "org.update_default_repository_permission",
- "description": "The default repository permission level for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "org.update_saml_provider_settings",
- "description": "An organization's SAML provider settings were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_terms_of_service",
- "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
- "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
- },
- {
- "action": "organization_domain.approve",
- "description": "A domain was approved for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.create",
- "description": "A domain was added to an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.destroy",
- "description": "A domain was removed from an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain"
- },
- {
- "action": "organization_domain.verify",
- "description": "A domain was verified for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "packages.package_deleted",
- "description": "An entire package was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_published",
- "description": "A package was published or republished to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "packages.package_version_deleted",
- "description": "A specific package version was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_version_published",
- "description": "A specific package version was published or republished to a package.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "passkey.register",
- "description": "A new passkey was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "passkey.remove",
- "description": "A new passkey was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.create",
- "description": "Triggered when you create a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_regenerated",
- "description": "Triggered when you regenerate a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_revoked",
- "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
- "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users"
- },
- {
- "action": "personal_access_token.destroy",
- "description": "Triggered when you delete a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.update",
- "description": "A fine-grained personal access token was updated.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.authorized_users_teams",
- "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
- },
- {
- "action": "protected_branch.create",
- "description": "Branch protection was enabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.destroy",
- "description": "Branch protection was disabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismiss_stale_reviews",
- "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismissal_restricted_users_teams",
- "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.policy_override",
- "description": "A branch protection requirement was overridden by a repository administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.rejected_ref_update",
- "description": "A branch update attempt was rejected.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_admin_enforced",
- "description": "Branch protection was enforced for repository administrators.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_deletions_enforcement_level",
- "description": "Branch deletion was enabled or disabled for a protected branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_force_pushes_enforcement_level",
- "description": "Force pushes were enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_ignore_approvals_from_contributors",
- "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "protected_branch.update_linear_history_requirement_enforcement_level",
- "description": "Required linear commit history was enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_lock_allows_fetch_and_merge",
- "description": "Fork syncing was enabled or disabled for a read-only branch",
- "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_lock_branch_enforcement_level",
- "description": "The enforcement of a branch lock was updated.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "protected_branch.update_name",
- "description": "A branch name pattern was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_pull_request_reviews_enforcement_level",
- "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_code_owner_review",
- "description": "Enforcement of required code owner review was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_last_push_approval",
- "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
- },
- {
- "action": "protected_branch.update_required_approving_review_count",
- "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_required_status_checks_enforcement_level",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_signature_requirement_enforcement_level",
- "description": "Enforcement of required commit signing was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_strict_required_status_checks_policy",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "pull_request.close",
- "description": "A pull request was closed without being merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
- },
- {
- "action": "pull_request.converted_to_draft",
- "description": "A pull request was converted to a draft.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
- },
- {
- "action": "pull_request.create",
- "description": "A pull request was created.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request"
- },
- {
- "action": "pull_request.create_review_request",
- "description": "A review was requested on a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.in_progress",
- "description": "A pull request was marked as in progress.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.indirect_merge",
- "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.merge",
- "description": "A pull request was merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
- },
- {
- "action": "pull_request.ready_for_review",
- "description": "A pull request was marked as ready for review.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
- },
- {
- "action": "pull_request.rebase",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.remove_review_request",
- "description": "A review request was removed from a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.reopen",
- "description": "A pull request was reopened after previously being closed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.create",
- "description": "A review comment was added to a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request_review_comment.delete",
- "description": "A review comment on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.update",
- "description": "A review comment on a pull request was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.delete",
- "description": "A review on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.dismiss",
- "description": "A review on a pull request was dismissed.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
- },
- {
- "action": "pull_request_review.submit",
- "description": "A review on a pull request was submitted.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.disk_archive",
- "description": "A repository was archived on disk.",
- "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories"
- },
- {
- "action": "repo.download_zip",
- "description": "A source code archive of a repository was downloaded as a ZIP file.",
- "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives"
- },
- {
- "action": "repo.hide_from_discovery",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.noindex",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.override_unlock",
- "description": "The repository was unlocked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_build",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.require_login",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.temporary_access_granted",
- "description": "Temporary access was enabled for a repository.",
- "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_ruleset.create",
- "description": "A repository ruleset was created.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
- },
- {
- "action": "repository_ruleset.destroy",
- "description": "A repository ruleset was deleted.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
- },
- {
- "action": "repository_ruleset.update",
- "description": "A repository ruleset was edited.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning.disable",
- "description": "Secret scanning was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "repository_secret_scanning.enable",
- "description": "Secret scanning was enabled for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_push_protection.disable",
- "description": "Secret scanning push protection was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_secret_scanning_push_protection.enable",
- "description": "Secret scanning push protection was enabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "restrict_notification_delivery.disable",
- "description": "Email notification restrictions for an organization or enterprise were disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "restrict_notification_delivery.enable",
- "description": "Email notification restrictions for an organization or enterprise were enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "secret_scanning_alert.create",
- "description": "GitHub detected a secret and created a secret scanning alert.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
- },
- {
- "action": "secret_scanning_alert.reopen",
- "description": "A secret scanning alert was reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.resolve",
- "description": "A secret scanning alert was resolved.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.revoke",
- "description": "A secret scanning alert was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning.disable",
- "description": "Secret scanning was disabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning.enable",
- "description": "Secret scanning was enabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.disable",
- "description": "Secret scanning was disabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.enable",
- "description": "Secret scanning was enabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_push_protection.bypass",
- "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret"
- },
- {
- "action": "security_key.register",
- "description": "A security key was registered for an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "security_key.remove",
- "description": "A security key was removed from an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.sponsored_developer_update_newsletter_send",
- "description": "Triggered when you send an email update to your sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.waitlist_join",
- "description": "You join the waitlist to join GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ssh_certificate_authority.create",
- "description": "An SSH certificate authority for an organization or enterprise was created.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_authority.destroy",
- "description": "An SSH certificate authority for an organization or enterprise was deleted.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.disable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.enable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "staff.set_domain_token_expiration",
- "description": "The verification code expiry time for an organization or enterprise domain was set.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.unverify_domain",
- "description": "An organization or enterprise domain was unverified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.verify_domain",
- "description": "An organization or enterprise domain was verified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.accept",
- "description": "Triggered when you accept a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.cancel",
- "description": "Triggered when you cancel a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.create",
- "description": "Triggered when you create a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.decline",
- "description": "Triggered when you decline a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.revoke",
- "description": "Triggered when you revoke a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "team.add_member",
- "description": "A member of an organization was added to a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
- },
- {
- "action": "team.add_repository",
- "description": "A team was given access and permissions to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.change_parent_team",
- "description": "A child team was created or a child team's parent was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
- },
- {
- "action": "team.change_privacy",
- "description": "A team's privacy level was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility"
- },
- {
- "action": "team.create",
- "description": "A new team is created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.demote_maintainer",
- "description": "A user was demoted from a team maintainer to a team member.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
- },
- {
- "action": "team.destroy",
- "description": "A team was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization"
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.promote_maintainer",
- "description": "A user was promoted from a team member to a team maintainer.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
- },
- {
- "action": "team.remove_member",
- "description": "An organization member was removed from a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
- },
- {
- "action": "team.remove_repository",
- "description": "A repository was removed from a team's control.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.rename",
- "description": "A team's name was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_sync_tenant.disabled",
- "description": "Team synchronization with a tenant was disabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.enabled",
- "description": "Team synchronization with a tenant was enabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team.update_repository_permission",
- "description": "A team's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.register",
- "description": "A new trusted device was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.remove",
- "description": "A trusted device was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.abort",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.complete",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.ignore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_approve",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_decline",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.start",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.two_factor_destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.add_factor",
- "description": "A secondary authentication factor was added to a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.disabled",
- "description": "Two-factor authentication was disabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account"
- },
- {
- "action": "two_factor_authentication.enabled",
- "description": "Two-factor authentication was enabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.password_reset_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.recovery_codes_regenerated",
- "description": "Two factor recovery codes were regenerated for a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.remove_factor",
- "description": "A secondary authentication factor was removed from a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.sign_in_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.update_fallback",
- "description": "The two-factor authentication fallback for a user account was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.add_email",
- "description": "An email address was added to a user account.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account"
- },
- {
- "action": "user.async_delete",
- "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.audit_log_export",
- "description": "Audit log entries were exported.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.block_user",
- "description": "A user was blocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.change_password",
- "description": "A user changed their password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.codespaces_trusted_repo_access_granted",
- "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.codespaces_trusted_repo_access_revoked",
- "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.correct_password_from_unrecognized_device",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.correct_password_from_unrecognized_device_and_location",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.correct_password_from_unrecognized_location",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create",
- "description": "A new user account was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create_integration_secret",
- "description": "A user secret for Codespaces was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.creation_rate_limit_exceeded",
- "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.delete",
- "description": "A user account was destroyed by an asynchronous job.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.demote",
- "description": "A site administrator was demoted to an ordinary user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.destroy",
- "description": "A user deleted his or her account, triggering user.async_delete.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_failure",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_requested",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_success",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.failed_login",
- "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.flag_as_large_scale_contributor",
- "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.forgot_password",
- "description": "A user requested a password reset.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
- },
- {
- "action": "user.grant_github_developer",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.hide_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.login",
- "description": "A user signed in.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.logout",
- "description": "A user signed out.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.minimize_comment",
- "description": "A comment made by a user was minimized.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.new_device_used",
- "description": "A user signed in from a new device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.partial_two_factor_email_followup",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.promote",
- "description": "An ordinary user account was promoted to a site administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.recreate",
- "description": "A user's account was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_email",
- "description": "An email address was removed from a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_integration_secret",
- "description": "A user secret for Codespaces was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_large_scale_contributor_flag",
- "description": "A user account was no longer flagged as a large scale contributor.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.rename",
- "description": "A username was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.report_abuse",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.report_content",
- "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam"
- },
- {
- "action": "user.reset_password",
- "description": "A user reset their account password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_session.country_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.show_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.sign_in_from_unrecognized_device",
- "description": "A user signed in from an unrecognized device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_device_and_location",
- "description": "A user signed in from an unrecognized device and location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_location",
- "description": "A user signed in from an unrecognized location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.destroy",
- "description": "Triggered when you clear the status on your profile.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.update",
- "description": "Triggered when you set or change the status on your profile.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status"
- },
- {
- "action": "user.suspend",
- "description": "A user account was suspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.toggle_warn_private_email",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_failure",
- "description": "A 2FA challenge issued for a user account failed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_success",
- "description": "A 2FA challenge issued for a user account succeeded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recover",
- "description": "A user used their 2FA recovery codes.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_downloaded",
- "description": "A user downloaded 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_printed",
- "description": "A user printed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_viewed",
- "description": "A user viewed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_requested",
- "description": "A user was prompted for a two-factor authentication code.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
- },
- {
- "action": "user.unblock_user",
- "description": "A user was unblocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unminimize_comment",
- "description": "A comment made by a user was unminimized.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unsuspend",
- "description": "A user account was unsuspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_integration_secret",
- "description": "A user secret for Codespaces was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_new_repository_default_branch_setting",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.cancel_workflow_run",
- "description": "A workflow run was cancelled.",
- "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.completed_workflow_run",
- "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history"
- },
- {
- "action": "workflows.created_workflow_run",
- "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.prepared_workflow_job",
- "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.rerun_workflow_run",
- "description": "A workflow run was re-run.",
- "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.10/organization.json b/src/audit-logs/data/ghes-3.10/organization.json
deleted file mode 100644
index 8b24e21e4cbf..000000000000
--- a/src/audit-logs/data/ghes-3.10/organization.json
+++ /dev/null
@@ -1,2882 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.accept",
- "description": "Credit was accepted for a security advisory.",
- "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
- },
- {
- "action": "advisory_credit.create",
- "description": "Someone was added to the credit section of a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.decline",
- "description": "Credit was declined for a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.destroy",
- "description": "Someone was removed from the credit section of a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "auto_approve_personal_access_token_requests.disable",
- "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
- },
- {
- "action": "auto_approve_personal_access_token_requests.enable",
- "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.attempted_to_create_from_prebuild",
- "description": "An attempt to create a codespace from a prebuild was made.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.business_enablement_updated",
- "description": "Enterprise setting for Codespaces ownership was updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_created",
- "description": "Policies were applied to codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_deleted",
- "description": "Policies were removed from codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_updated",
- "description": "Policies were updated for codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "commit_comment.destroy",
- "description": "A commit comment was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "commit_comment.update",
- "description": "A commit comment was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_comment.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_comment.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "enterprise_installation.create",
- "description": "The GitHub App associated with a GitHub Connect connection was created.",
- "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect"
- },
- {
- "action": "enterprise_installation.destroy",
- "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
- "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "git.clone",
- "description": "A repository was cloned.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.fetch",
- "description": "Changes were fetched from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.push",
- "description": "Changes were pushed to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation_request.close",
- "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
- "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
- },
- {
- "action": "integration_installation_request.create",
- "description": "A member requested that an owner install a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "ip_allow_list.disable",
- "description": "An IP allow list was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_for_installed_apps",
- "description": "An IP allow list was disabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable",
- "description": "An IP allow list was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_for_installed_apps",
- "description": "An IP allow list was enabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.create",
- "description": "An IP address was added to an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.destroy",
- "description": "An IP address was deleted from an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.update",
- "description": "An IP address or its description was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue_comment.destroy",
- "description": "A comment on an issue was deleted from the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue_comment.update",
- "description": "A comment on an issue (other than the initial one) changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue.destroy",
- "description": "An issue was deleted from the repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue"
- },
- {
- "action": "issue.pinned",
- "description": "An issue was pinned to a repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository"
- },
- {
- "action": "issue.transfer",
- "description": "An issue was transferred to another repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository"
- },
- {
- "action": "issue.unpinned",
- "description": "An issue was unpinned from a repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository"
- },
- {
- "action": "issues.deletes_disabled",
- "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "issues.deletes_enabled",
- "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "issues.deletes_policy_cleared",
- "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "members_can_create_pages.disable",
- "description": "The ability for members to publish GitHub Pages sites was disabled.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_pages.enable",
- "description": "The ability for members to publish GitHub Pages sites was enabled.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_private_pages.disable",
- "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_private_pages.enable",
- "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_public_pages.disable",
- "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_public_pages.enable",
- "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_delete_repos.clear",
- "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_delete_repos.disable",
- "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_delete_repos.enable",
- "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_view_dependency_insights.clear",
- "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "members_can_view_dependency_insights.disable",
- "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise"
- },
- {
- "action": "members_can_view_dependency_insights.enable",
- "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.destroy_file",
- "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.download",
- "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "org.accept_business_invitation",
- "description": "An invitation sent to an organization to join an enterprise was accepted.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.add_billing_manager",
- "description": "A billing manager was added to an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_policy_selected_member_disabled",
- "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.advanced_security_policy_selected_member_enabled",
- "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled",
- "description": "Third-party application access for outside collaborators was disabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
- },
- {
- "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
- "description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
- },
- {
- "action": "org.archive",
- "description": "The organization was archived.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.audit_log_export",
- "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
- },
- {
- "action": "org.audit_log_git_event_export",
- "description": "An export of the organization's Git events was created.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
- },
- {
- "action": "org.billing_signup_error",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.block_user",
- "description": "An organization owner blocked a user from accessing the organization's repositories.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
- },
- {
- "action": "org.cancel_business_invitation",
- "description": "An invitation for an organization to join an enterprise was revoked",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.cancel_invitation",
- "description": "An invitation sent to a user to join an organization was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.clear_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codespaces_trusted_repo_access_granted",
- "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "org.codespaces_trusted_repo_access_revoked",
- "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "org.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.confirm_business_invitation",
- "description": "An invitation for an organization to join an enterprise was confirmed.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.connect_usage_metrics_export",
- "description": "Server statistics were exported for the organization.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics"
- },
- {
- "action": "org.create",
- "description": "An organization was created.",
- "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
- },
- {
- "action": "org.create_actions_secret",
- "description": "A GitHub Actions secret was created for an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.create_actions_variable",
- "description": "A GitHub Actions variable was created for an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org_credential_authorization.deauthorize",
- "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
- "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on"
- },
- {
- "action": "org_credential_authorization.grant",
- "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
- "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on"
- },
- {
- "action": "org_credential_authorization.revoke",
- "description": "An owner revoked authorized credentials.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization"
- },
- {
- "action": "org.disable_member_team_creation_permission",
- "description": "Team creation was limited to owners.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.disable_oauth_app_restrictions",
- "description": "Third-party application access restrictions for an organization were disabled.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
- },
- {
- "action": "org.disable_reader_discussion_creation_permission",
- "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.disable_saml",
- "description": "SAML single sign-on was disabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the organization was disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
- },
- {
- "action": "org.disable_two_factor_requirement",
- "description": "A two-factor authentication requirement was disabled for the organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_disabled",
- "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_enabled",
- "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.enable_member_team_creation_permission",
- "description": "Team creation by members was allowed.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.enable_oauth_app_restrictions",
- "description": "Third-party application access restrictions for an organization were enabled.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
- },
- {
- "action": "org.enable_reader_discussion_creation_permission",
- "description": "An organization owner allowed users with read access to create discussions in an organization",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.enable_saml",
- "description": "SAML single sign-on was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization"
- },
- {
- "action": "org.enable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the organization was enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
- },
- {
- "action": "org.enable_two_factor_requirement",
- "description": "Two-factor authentication is now required for the organization.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.integration_manager_added",
- "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.integration_manager_removed",
- "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.invite_member",
- "description": "A new user was invited to join an organization.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
- },
- {
- "action": "org.invite_to_business",
- "description": "An organization was invited to join an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.oauth_app_access_approved",
- "description": "Access to an organization was granted for an OAuth App.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
- },
- {
- "action": "org.oauth_app_access_denied",
- "description": "Access was disabled for an OAuth App that was previously approved.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
- },
- {
- "action": "org.oauth_app_access_requested",
- "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.rate_limited_invites",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization"
- },
- {
- "action": "org.remove_actions_secret",
- "description": "A GitHub Actions secret was removed from an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.remove_actions_variable",
- "description": "A GitHub Actions variable was removed from an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.remove_billing_manager",
- "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was removed from an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_outside_collaborator",
- "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization"
- },
- {
- "action": "org.rename",
- "description": "An organization was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.required_workflow_create",
- "description": "Triggered when a required workflow is created.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.required_workflow_delete",
- "description": "Triggered when a required workflow is deleted.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.required_workflow_update",
- "description": "Triggered when a required workflow is updated.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.restore_member",
- "description": "An organization member was restored.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
- },
- {
- "action": "org.revoke_external_identity",
- "description": "A member's linked identity was revoked.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity"
- },
- {
- "action": "org.revoke_sso_session",
- "description": "A member's SAML session was revoked.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity"
- },
- {
- "action": "org.runner_group_created",
- "description": "A self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org.runner_group_removed",
- "description": "A self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_renamed",
- "description": "A self-hosted runner group was renamed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_runner_removed",
- "description": "The REST API was used to remove a self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_runners_added",
- "description": "A self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "org.runner_group_runners_updated",
- "description": "A runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_updated",
- "description": "The configuration of a self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_visiblity_updated",
- "description": "The visibility of a self-hosted runner group was updated via the REST API.",
- "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "org_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_disabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_enabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_updated",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_disable",
- "description": "Push protection for secret scanning was disabled.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "org.secret_scanning_push_protection_enable",
- "description": "Push protection for secret scanning was enabled.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_disable",
- "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_enable",
- "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.transfer",
- "description": "An organization was transferred between enterprise accounts.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts"
- },
- {
- "action": "org.transfer_outgoing",
- "description": "An organization was transferred between enterprise accounts.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts"
- },
- {
- "action": "org.unarchive",
- "description": "The organization was unarchived.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.unblock_user",
- "description": "A user was unblocked from an organization.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
- },
- {
- "action": "org.update_actions_secret",
- "description": "A GitHub Actions secret was updated for an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.update_actions_settings",
- "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
- },
- {
- "action": "org.update_actions_variable",
- "description": "A GitHub Actions variable was updated for an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.update_default_repository_permission",
- "description": "The default repository permission level for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "org.update_new_repository_default_branch_setting",
- "description": "The name of the default branch was changed for new repositories in the organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
- },
- {
- "action": "org.update_saml_provider_settings",
- "description": "An organization's SAML provider settings were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_terms_of_service",
- "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
- "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
- },
- {
- "action": "organization_default_label.create",
- "description": "A default label was created for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
- },
- {
- "action": "organization_default_label.destroy",
- "description": "A default label was deleted for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
- },
- {
- "action": "organization_default_label.update",
- "description": "A default label was edited for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
- },
- {
- "action": "organization_domain.approve",
- "description": "A domain was approved for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.create",
- "description": "A domain was added to an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.destroy",
- "description": "A domain was removed from an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain"
- },
- {
- "action": "organization_domain.verify",
- "description": "A domain was verified for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_moderators.add_team",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.add_user",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.remove_team",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.remove_user",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_projects_change.clear",
- "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "organization_projects_change.disable",
- "description": "Organization projects were disabled for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "organization_projects_change.enable",
- "description": "Organization projects were enabled for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "packages.package_deleted",
- "description": "An entire package was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_published",
- "description": "A package was published or republished to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "packages.package_version_deleted",
- "description": "A specific package version was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_version_published",
- "description": "A specific package version was published or republished to a package.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "prebuild_configuration.create",
- "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.destroy",
- "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.run_triggered",
- "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.update",
- "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.clear",
- "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.disable",
- "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.enable",
- "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.authorized_users_teams",
- "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
- },
- {
- "action": "protected_branch.create",
- "description": "Branch protection was enabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.destroy",
- "description": "Branch protection was disabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismiss_stale_reviews",
- "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismissal_restricted_users_teams",
- "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.policy_override",
- "description": "A branch protection requirement was overridden by a repository administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.rejected_ref_update",
- "description": "A branch update attempt was rejected.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_admin_enforced",
- "description": "Branch protection was enforced for repository administrators.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_deletions_enforcement_level",
- "description": "Branch deletion was enabled or disabled for a protected branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_force_pushes_enforcement_level",
- "description": "Force pushes were enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_ignore_approvals_from_contributors",
- "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "protected_branch.update_linear_history_requirement_enforcement_level",
- "description": "Required linear commit history was enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_lock_allows_fetch_and_merge",
- "description": "Fork syncing was enabled or disabled for a read-only branch",
- "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_lock_branch_enforcement_level",
- "description": "The enforcement of a branch lock was updated.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "protected_branch.update_name",
- "description": "A branch name pattern was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_pull_request_reviews_enforcement_level",
- "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_code_owner_review",
- "description": "Enforcement of required code owner review was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_last_push_approval",
- "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
- },
- {
- "action": "protected_branch.update_required_approving_review_count",
- "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_required_status_checks_enforcement_level",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_signature_requirement_enforcement_level",
- "description": "Enforcement of required commit signing was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_strict_required_status_checks_policy",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "pull_request.close",
- "description": "A pull request was closed without being merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
- },
- {
- "action": "pull_request.converted_to_draft",
- "description": "A pull request was converted to a draft.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
- },
- {
- "action": "pull_request.create",
- "description": "A pull request was created.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request"
- },
- {
- "action": "pull_request.create_review_request",
- "description": "A review was requested on a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.in_progress",
- "description": "A pull request was marked as in progress.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.indirect_merge",
- "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.merge",
- "description": "A pull request was merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
- },
- {
- "action": "pull_request.ready_for_review",
- "description": "A pull request was marked as ready for review.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
- },
- {
- "action": "pull_request.rebase",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.remove_review_request",
- "description": "A review request was removed from a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.reopen",
- "description": "A pull request was reopened after previously being closed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.create",
- "description": "A review comment was added to a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request_review_comment.delete",
- "description": "A review comment on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.update",
- "description": "A review comment on a pull request was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.delete",
- "description": "A review on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.dismiss",
- "description": "A review on a pull request was dismissed.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
- },
- {
- "action": "pull_request_review.submit",
- "description": "A review on a pull request was submitted.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codespaces_trusted_repo_access_granted",
- "description": "GitHub Codespaces was granted trusted repository access to this repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.codespaces_trusted_repo_access_revoked",
- "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.download_zip",
- "description": "A source code archive of a repository was downloaded as a ZIP file.",
- "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.rename_branch",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.close",
- "description": "Someone closed a security advisory.",
- "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
- },
- {
- "action": "repository_advisory.cve_request",
- "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.github_broadcast",
- "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.github_withdraw",
- "description": "GitHub withdrew a security advisory that was published in error.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.open",
- "description": "Someone opened a draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.publish",
- "description": "Someone published a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.reopen",
- "description": "Someone reopened as draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.update",
- "description": "Someone edited a draft or published security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_content_analysis.disable",
- "description": "Data use settings were disabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_content_analysis.enable",
- "description": "Data use settings were enabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_dependency_graph.disable",
- "description": "The dependency graph was disabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_dependency_graph.enable",
- "description": "The dependency graph was enabled for a private repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_projects_change.clear",
- "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise"
- },
- {
- "action": "repository_projects_change.disable",
- "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_projects_change.enable",
- "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_ruleset.create",
- "description": "A repository ruleset was created.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
- },
- {
- "action": "repository_ruleset.destroy",
- "description": "A repository ruleset was deleted.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
- },
- {
- "action": "repository_ruleset.update",
- "description": "A repository ruleset was edited.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning.disable",
- "description": "Secret scanning was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "repository_secret_scanning.enable",
- "description": "Secret scanning was enabled for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_push_protection.disable",
- "description": "Secret scanning push protection was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_secret_scanning_push_protection.enable",
- "description": "Secret scanning push protection was enabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_visibility_change.clear",
- "description": "The repository visibility change setting was cleared for an organization or enterprise.",
- "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility"
- },
- {
- "action": "repository_visibility_change.disable",
- "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_visibility_change.enable",
- "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.auto_dismiss",
- "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts"
- },
- {
- "action": "repository_vulnerability_alert.auto_reopen",
- "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts"
- },
- {
- "action": "repository_vulnerability_alert.create",
- "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
- },
- {
- "action": "repository_vulnerability_alert.dismiss",
- "description": "A Dependabot alert was manually dismissed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.reintroduce",
- "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.reopen",
- "description": "A Dependabot alert was manually reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.resolve",
- "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.authorized_users_teams",
- "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
- },
- {
- "action": "repository_vulnerability_alerts_auto_dismissal.disable",
- "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts_auto_dismissal.enable",
- "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.disable",
- "description": "Dependabot alerts was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.enable",
- "description": "Dependabot alerts was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "required_status_check.create",
- "description": "A status check was marked as required for a protected branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
- },
- {
- "action": "required_status_check.destroy",
- "description": "A status check was no longer marked as required for a protected branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
- },
- {
- "action": "restrict_notification_delivery.disable",
- "description": "Email notification restrictions for an organization or enterprise were disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "restrict_notification_delivery.enable",
- "description": "Email notification restrictions for an organization or enterprise were enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "role.create",
- "description": "A new custom repository role was created.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "role.destroy",
- "description": "A custom repository role was deleted.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "role.update",
- "description": "A custom repository role was edited.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "secret_scanning_alert.create",
- "description": "GitHub detected a secret and created a secret scanning alert.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
- },
- {
- "action": "secret_scanning_alert.reopen",
- "description": "A secret scanning alert was reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.resolve",
- "description": "A secret scanning alert was resolved.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.revoke",
- "description": "A secret scanning alert was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning.disable",
- "description": "Secret scanning was disabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning.enable",
- "description": "Secret scanning was enabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.disable",
- "description": "Secret scanning was disabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.enable",
- "description": "Secret scanning was enabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_push_protection.bypass",
- "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.invoiced_agreement_sign",
- "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ssh_certificate_authority.create",
- "description": "An SSH certificate authority for an organization or enterprise was created.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_authority.destroy",
- "description": "An SSH certificate authority for an organization or enterprise was deleted.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.disable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.enable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.set_domain_token_expiration",
- "description": "The verification code expiry time for an organization or enterprise domain was set.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.unverify_domain",
- "description": "An organization or enterprise domain was unverified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.verify_domain",
- "description": "An organization or enterprise domain was verified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.add_member",
- "description": "A member of an organization was added to a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
- },
- {
- "action": "team.add_repository",
- "description": "A team was given access and permissions to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.change_parent_team",
- "description": "A child team was created or a child team's parent was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
- },
- {
- "action": "team.change_privacy",
- "description": "A team's privacy level was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility"
- },
- {
- "action": "team.create",
- "description": "A new team is created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.demote_maintainer",
- "description": "A user was demoted from a team maintainer to a team member.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
- },
- {
- "action": "team.destroy",
- "description": "A team was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization"
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.promote_maintainer",
- "description": "A user was promoted from a team member to a team maintainer.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
- },
- {
- "action": "team.remove_member",
- "description": "An organization member was removed from a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
- },
- {
- "action": "team.remove_repository",
- "description": "A repository was removed from a team's control.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.rename",
- "description": "A team's name was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_sync_tenant.disabled",
- "description": "Team synchronization with a tenant was disabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.enabled",
- "description": "Team synchronization with a tenant was enabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.update_okta_credentials",
- "description": "The Okta credentials for team synchronization with a tenant were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.update_repository_permission",
- "description": "A team's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.cancel_workflow_run",
- "description": "A workflow run was cancelled.",
- "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.completed_workflow_run",
- "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history"
- },
- {
- "action": "workflows.created_workflow_run",
- "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.prepared_workflow_job",
- "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.rerun_workflow_run",
- "description": "A workflow run was re-run.",
- "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.10/user.json b/src/audit-logs/data/ghes-3.10/user.json
deleted file mode 100644
index 2615a8222b55..000000000000
--- a/src/audit-logs/data/ghes-3.10/user.json
+++ /dev/null
@@ -1,1787 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "account_recovery_token.confirm",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.recover",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.update_bill_cycle_day",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.set_actions_fork_pr_approvals_policy",
- "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories"
- },
- {
- "action": "business.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise"
- },
- {
- "action": "business.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise"
- },
- {
- "action": "business.set_fork_pr_workflows_policy",
- "description": "The policy for fork pull request workflows was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "git_signing_ssh_public_key.create",
- "description": "An SSH key was added to a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "git_signing_ssh_public_key.delete",
- "description": "An SSH key was removed from a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.publish",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.retire",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.create",
- "description": "An OAuth access token was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token"
- },
- {
- "action": "oauth_access.destroy",
- "description": "An OAuth access token was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_access.regenerate",
- "description": "An OAuth access token was regenerated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.update",
- "description": "An OAuth access token was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_authorization.create",
- "description": "An authorization for an OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_authorization.destroy",
- "description": "An authorization for an OAuth application was deleted.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "passkey.register",
- "description": "A new passkey was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "passkey.remove",
- "description": "A new passkey was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.create",
- "description": "Triggered when you create a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_regenerated",
- "description": "Triggered when you regenerate a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_revoked",
- "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
- "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users"
- },
- {
- "action": "personal_access_token.destroy",
- "description": "Triggered when you delete a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.update",
- "description": "A fine-grained personal access token was updated.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.temporary_access_granted",
- "description": "Temporary access was enabled for a repository.",
- "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_ruleset.create",
- "description": "A repository ruleset was created.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
- },
- {
- "action": "repository_ruleset.destroy",
- "description": "A repository ruleset was deleted.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
- },
- {
- "action": "repository_ruleset.update",
- "description": "A repository ruleset was edited.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
- },
- {
- "action": "security_key.register",
- "description": "A security key was registered for an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "security_key.remove",
- "description": "A security key was removed from an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.sponsored_developer_update_newsletter_send",
- "description": "Triggered when you send an email update to your sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.waitlist_join",
- "description": "You join the waitlist to join GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.accept",
- "description": "Triggered when you accept a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.cancel",
- "description": "Triggered when you cancel a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.create",
- "description": "Triggered when you create a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.decline",
- "description": "Triggered when you decline a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.revoke",
- "description": "Triggered when you revoke a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "trusted_device.register",
- "description": "A new trusted device was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.remove",
- "description": "A trusted device was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.abort",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.complete",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.ignore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_approve",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_decline",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.start",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.two_factor_destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.add_factor",
- "description": "A secondary authentication factor was added to a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.disabled",
- "description": "Two-factor authentication was disabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account"
- },
- {
- "action": "two_factor_authentication.enabled",
- "description": "Two-factor authentication was enabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.password_reset_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.recovery_codes_regenerated",
- "description": "Two factor recovery codes were regenerated for a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.remove_factor",
- "description": "A secondary authentication factor was removed from a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.sign_in_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.update_fallback",
- "description": "The two-factor authentication fallback for a user account was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.add_email",
- "description": "An email address was added to a user account.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account"
- },
- {
- "action": "user.async_delete",
- "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.audit_log_export",
- "description": "Audit log entries were exported.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.block_user",
- "description": "A user was blocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.change_password",
- "description": "A user changed their password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.codespaces_trusted_repo_access_granted",
- "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.codespaces_trusted_repo_access_revoked",
- "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.create",
- "description": "A new user account was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create_integration_secret",
- "description": "A user secret for Codespaces was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.creation_rate_limit_exceeded",
- "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.delete",
- "description": "A user account was destroyed by an asynchronous job.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.demote",
- "description": "A site administrator was demoted to an ordinary user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.destroy",
- "description": "A user deleted his or her account, triggering user.async_delete.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_failure",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_requested",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_success",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.failed_login",
- "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.forgot_password",
- "description": "A user requested a password reset.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
- },
- {
- "action": "user.grant_github_developer",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.hide_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.login",
- "description": "A user signed in.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.logout",
- "description": "A user signed out.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.new_device_used",
- "description": "A user signed in from a new device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.promote",
- "description": "An ordinary user account was promoted to a site administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.recreate",
- "description": "A user's account was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_email",
- "description": "An email address was removed from a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_integration_secret",
- "description": "A user secret for Codespaces was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.rename",
- "description": "A username was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.reset_password",
- "description": "A user reset their account password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_session.country_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.show_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.sign_in_from_unrecognized_device",
- "description": "A user signed in from an unrecognized device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_device_and_location",
- "description": "A user signed in from an unrecognized device and location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.destroy",
- "description": "Triggered when you clear the status on your profile.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.update",
- "description": "Triggered when you set or change the status on your profile.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status"
- },
- {
- "action": "user.suspend",
- "description": "A user account was suspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.toggle_warn_private_email",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_failure",
- "description": "A 2FA challenge issued for a user account failed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_success",
- "description": "A 2FA challenge issued for a user account succeeded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recover",
- "description": "A user used their 2FA recovery codes.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_downloaded",
- "description": "A user downloaded 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_printed",
- "description": "A user printed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_viewed",
- "description": "A user viewed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_requested",
- "description": "A user was prompted for a two-factor authentication code.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
- },
- {
- "action": "user.unblock_user",
- "description": "A user was unblocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unsuspend",
- "description": "A user account was unsuspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_integration_secret",
- "description": "A user secret for Codespaces was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_new_repository_default_branch_setting",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.11/enterprise.json b/src/audit-logs/data/ghes-3.11/enterprise.json
deleted file mode 100644
index 33899ea78129..000000000000
--- a/src/audit-logs/data/ghes-3.11/enterprise.json
+++ /dev/null
@@ -1,3332 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "account_recovery_token.confirm",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.recover",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "api.request",
- "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.check",
- "description": "A manual check of the endpoint configured for audit log streaming was performed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.create",
- "description": "An endpoint was added for audit log streaming.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.destroy",
- "description": "An audit log streaming endpoint was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.update",
- "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.update_bill_cycle_day",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.add_admin",
- "description": "An enterprise owner was added to an enterprise.",
- "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise"
- },
- {
- "action": "business.add_organization",
- "description": "An organization was added to an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_advanced_security.disabled",
- "description": "GitHub Advanced Security was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.enabled",
- "description": "GitHub Advanced Security was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business.advanced_security_policy_update",
- "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise"
- },
- {
- "action": "business.advanced_security_repo_admin_enablement_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.clear_actions_settings",
- "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise"
- },
- {
- "action": "business.clear_default_repository_permission",
- "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions"
- },
- {
- "action": "business.clear_members_can_create_repos",
- "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation"
- },
- {
- "action": "business.create",
- "description": "An enterprise was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.dependabot_alerts_repo_admin_enablement_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.disable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise"
- },
- {
- "action": "business.disable_two_factor_requirement",
- "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.enable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise"
- },
- {
- "action": "business.enable_two_factor_requirement",
- "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.clear",
- "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.remove_admin",
- "description": "An enterprise owner was removed from an enterprise.",
- "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise"
- },
- {
- "action": "business.remove_organization",
- "description": "An organization was removed from an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.rename_slug",
- "description": "The slug for the enterprise URL was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the business level",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features"
- },
- {
- "action": "business_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the business level",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features"
- },
- {
- "action": "business_secret_scanning_custom_pattern.create",
- "description": "An enterprise-level custom pattern was created for secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern.delete",
- "description": "An enterprise-level custom pattern was removed from secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_custom_pattern.publish",
- "description": "An enterprise-level custom pattern was published for secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern.update",
- "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning.disable",
- "description": "Secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.disabled_for_new_repos",
- "description": "Secret scanning was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.enable",
- "description": "Secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.enabled_for_new_repos",
- "description": "Secret scanning was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.disable",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.enable",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.update",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.disable",
- "description": "Push protection for secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.disabled_for_new_repos",
- "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.enable",
- "description": "Push protection for secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.enabled_for_new_repos",
- "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business.secret_scanning_repo_admin_settings_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.set_actions_fork_pr_approvals_policy",
- "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories"
- },
- {
- "action": "business.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise"
- },
- {
- "action": "business.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise"
- },
- {
- "action": "business.set_fork_pr_workflows_policy",
- "description": "The policy for fork pull request workflows was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "business.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.update_actions_settings",
- "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise"
- },
- {
- "action": "business.update_default_repository_permission",
- "description": "The base repository permission setting was updated for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions"
- },
- {
- "action": "business.update_member_repository_creation_permission",
- "description": "The repository creation setting was updated for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation"
- },
- {
- "action": "business.update_member_repository_invitation_permission",
- "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "copilot.cfb_seat_added",
- "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_created",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
- "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business"
- },
- {
- "action": "copilot.cfb_seat_assignment_refreshed",
- "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_reused",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_unassigned",
- "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled_by_staff",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "enterprise_announcement.create",
- "description": "A global announcement banner was created for the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner"
- },
- {
- "action": "enterprise_announcement.destroy",
- "description": "A global announcement banner was removed from the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise"
- },
- {
- "action": "enterprise_announcement.update",
- "description": "A global announcement banner was updated for the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise"
- },
- {
- "action": "enterprise.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "enterprise_domain.approve",
- "description": "A domain was approved for an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise_domain.create",
- "description": "A domain was added to an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise_domain.destroy",
- "description": "A domain was removed from an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain"
- },
- {
- "action": "enterprise_domain.verify",
- "description": "A domain was verified for an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise.register_self_hosted_runner",
- "description": "A new GitHub Actions self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "enterprise.remove_self_hosted_runner",
- "description": "A GitHub Actions self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "enterprise.runner_group_created",
- "description": "A GitHub Actions self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "enterprise.runner_group_removed",
- "description": "A GitHub Actions self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "enterprise.runner_group_runner_removed",
- "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "enterprise.runner_group_runners_added",
- "description": "A GitHub Actions self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "enterprise.runner_group_runners_updated",
- "description": "A GitHub Actions runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "enterprise.runner_group_updated",
- "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "enterprise.self_hosted_runner_offline",
- "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "enterprise.self_hosted_runner_online",
- "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "enterprise.self_hosted_runner_updated",
- "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "gist.create",
- "description": "A gist was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gist.destroy",
- "description": "A gist was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gist.visibility_change",
- "description": "The visibility of a gist was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.clone",
- "description": "A repository was cloned.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.fetch",
- "description": "Changes were fetched from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.push",
- "description": "Changes were pushed to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git_signing_ssh_public_key.create",
- "description": "An SSH key was added to a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "git_signing_ssh_public_key.delete",
- "description": "An SSH key was removed from a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "ip_allow_list.disable",
- "description": "An IP allow list was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_for_installed_apps",
- "description": "An IP allow list was disabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_user_level_enforcement",
- "description": "IP allow list user level enforcement was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable",
- "description": "An IP allow list was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_for_installed_apps",
- "description": "An IP allow list was enabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_user_level_enforcement",
- "description": "IP allow list user level enforcement was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.create",
- "description": "An IP address was added to an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.destroy",
- "description": "An IP address was deleted from an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.update",
- "description": "An IP address or its description was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.publish",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.retire",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.create",
- "description": "An OAuth access token was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token"
- },
- {
- "action": "oauth_access.destroy",
- "description": "An OAuth access token was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_access.regenerate",
- "description": "An OAuth access token was regenerated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.update",
- "description": "An OAuth access token was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.suspend",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.unsuspend",
- "description": "An OAuth application was unsuspended for a user or organization account.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_authorization.create",
- "description": "An authorization for an OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_authorization.destroy",
- "description": "An authorization for an OAuth application was deleted.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations"
- },
- {
- "action": "oauth_authorization.update",
- "description": "An authorization for an OAuth application was updated.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "org.accept_business_invitation",
- "description": "An invitation sent to an organization to join an enterprise was accepted.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.add_billing_manager",
- "description": "A billing manager was added to an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_policy_selected_member_disabled",
- "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.advanced_security_policy_selected_member_enabled",
- "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.async_delete",
- "description": "A user initiated a background job to delete an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.audit_log_export",
- "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
- },
- {
- "action": "org.billing_signup_error",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.block_user",
- "description": "An organization owner blocked a user from accessing the organization's repositories.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
- },
- {
- "action": "org.cancel_business_invitation",
- "description": "An invitation for an organization to join an enterprise was revoked",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.cancel_invitation",
- "description": "An invitation sent to a user to join an organization was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.clear_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.confirm_business_invitation",
- "description": "An invitation for an organization to join an enterprise was confirmed.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.create",
- "description": "An organization was created.",
- "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
- },
- {
- "action": "org.delete",
- "description": "An organization was deleted by a user or staff.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_member_team_creation_permission",
- "description": "Team creation was limited to owners.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.disable_reader_discussion_creation_permission",
- "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.disable_saml",
- "description": "SAML single sign-on was disabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_two_factor_requirement",
- "description": "A two-factor authentication requirement was disabled for the organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_disabled",
- "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_enabled",
- "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.enable_member_team_creation_permission",
- "description": "Team creation by members was allowed.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.enable_reader_discussion_creation_permission",
- "description": "An organization owner allowed users with read access to create discussions in an organization",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.enable_saml",
- "description": "SAML single sign-on was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization"
- },
- {
- "action": "org.enable_two_factor_requirement",
- "description": "Two-factor authentication is now required for the organization.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.integration_manager_added",
- "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.integration_manager_removed",
- "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.invite_member",
- "description": "A new user was invited to join an organization.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
- },
- {
- "action": "org.invite_to_business",
- "description": "An organization was invited to join an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.rate_limited_invites",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.recreate",
- "description": "An organization was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization"
- },
- {
- "action": "org.remove_billing_manager",
- "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_outside_collaborator",
- "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization"
- },
- {
- "action": "org.rename",
- "description": "An organization was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.restore_member",
- "description": "An organization member was restored.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
- },
- {
- "action": "org.runner_group_created",
- "description": "A self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org.runner_group_removed",
- "description": "A self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_runner_removed",
- "description": "The REST API was used to remove a self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_runners_added",
- "description": "A self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "org.runner_group_runners_updated",
- "description": "A runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_updated",
- "description": "The configuration of a self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the organization level",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
- },
- {
- "action": "org_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the organization level",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "org_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_disabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_enabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_updated",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_disable",
- "description": "Push protection for secret scanning was disabled.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "org.secret_scanning_push_protection_enable",
- "description": "Push protection for secret scanning was enabled.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_disable",
- "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_enable",
- "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.transform",
- "description": "A user account was converted into an organization.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization"
- },
- {
- "action": "org.unblock_user",
- "description": "A user was unblocked from an organization.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
- },
- {
- "action": "org.update_actions_settings",
- "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
- },
- {
- "action": "org.update_default_repository_permission",
- "description": "The default repository permission level for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "org.update_saml_provider_settings",
- "description": "An organization's SAML provider settings were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_terms_of_service",
- "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
- "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
- },
- {
- "action": "organization_domain.approve",
- "description": "A domain was approved for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.create",
- "description": "A domain was added to an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.destroy",
- "description": "A domain was removed from an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain"
- },
- {
- "action": "organization_domain.verify",
- "description": "A domain was verified for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "packages.package_deleted",
- "description": "An entire package was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_published",
- "description": "A package was published or republished to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "packages.package_version_deleted",
- "description": "A specific package version was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_version_published",
- "description": "A specific package version was published or republished to a package.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "passkey.register",
- "description": "A new passkey was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "passkey.remove",
- "description": "A new passkey was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.create",
- "description": "Triggered when you create a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_regenerated",
- "description": "Triggered when you regenerate a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_revoked",
- "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
- "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users"
- },
- {
- "action": "personal_access_token.destroy",
- "description": "Triggered when you delete a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.update",
- "description": "A fine-grained personal access token was updated.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.authorized_users_teams",
- "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
- },
- {
- "action": "protected_branch.branch_allowances",
- "description": "A protected branch allowance was given to a specific user, team or integration.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.create",
- "description": "Branch protection was enabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.destroy",
- "description": "Branch protection was disabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismiss_stale_reviews",
- "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismissal_restricted_users_teams",
- "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.policy_override",
- "description": "A branch protection requirement was overridden by a repository administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.rejected_ref_update",
- "description": "A branch update attempt was rejected.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_admin_enforced",
- "description": "Branch protection was enforced for repository administrators.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_deletions_enforcement_level",
- "description": "Branch deletion was enabled or disabled for a protected branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_force_pushes_enforcement_level",
- "description": "Force pushes were enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_ignore_approvals_from_contributors",
- "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "protected_branch.update_linear_history_requirement_enforcement_level",
- "description": "Required linear commit history was enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_lock_allows_fetch_and_merge",
- "description": "Fork syncing was enabled or disabled for a read-only branch",
- "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_lock_branch_enforcement_level",
- "description": "The enforcement of a branch lock was updated.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "protected_branch.update_name",
- "description": "A branch name pattern was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_pull_request_reviews_enforcement_level",
- "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_code_owner_review",
- "description": "Enforcement of required code owner review was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_last_push_approval",
- "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
- },
- {
- "action": "protected_branch.update_required_approving_review_count",
- "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_required_status_checks_enforcement_level",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_signature_requirement_enforcement_level",
- "description": "Enforcement of required commit signing was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_strict_required_status_checks_policy",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "pull_request.close",
- "description": "A pull request was closed without being merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
- },
- {
- "action": "pull_request.converted_to_draft",
- "description": "A pull request was converted to a draft.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
- },
- {
- "action": "pull_request.create",
- "description": "A pull request was created.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request"
- },
- {
- "action": "pull_request.create_review_request",
- "description": "A review was requested on a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.in_progress",
- "description": "A pull request was marked as in progress.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.indirect_merge",
- "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.merge",
- "description": "A pull request was merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
- },
- {
- "action": "pull_request.ready_for_review",
- "description": "A pull request was marked as ready for review.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
- },
- {
- "action": "pull_request.rebase",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.remove_review_request",
- "description": "A review request was removed from a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.reopen",
- "description": "A pull request was reopened after previously being closed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.create",
- "description": "A review comment was added to a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request_review_comment.delete",
- "description": "A review comment on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.update",
- "description": "A review comment on a pull request was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.delete",
- "description": "A review on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.dismiss",
- "description": "A review on a pull request was dismissed.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
- },
- {
- "action": "pull_request_review.submit",
- "description": "A review on a pull request was submitted.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.disk_archive",
- "description": "A repository was archived on disk.",
- "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories"
- },
- {
- "action": "repo.download_zip",
- "description": "A source code archive of a repository was downloaded as a ZIP file.",
- "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives"
- },
- {
- "action": "repo.hide_from_discovery",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.noindex",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.override_unlock",
- "description": "The repository was unlocked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_build",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.require_login",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.temporary_access_granted",
- "description": "Temporary access was enabled for a repository.",
- "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_branch_protection_evaluation.disable",
- "description": "Branch protections were disabled for the repository.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "repository_branch_protection_evaluation.enable",
- "description": "Branch protections were enabled for this repository.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_ruleset.create",
- "description": "A repository ruleset was created.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
- },
- {
- "action": "repository_ruleset.destroy",
- "description": "A repository ruleset was deleted.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
- },
- {
- "action": "repository_ruleset.update",
- "description": "A repository ruleset was edited.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
- },
- {
- "action": "repository_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the repository level",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
- },
- {
- "action": "repository_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the repository level",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning.disable",
- "description": "Secret scanning was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "repository_secret_scanning.enable",
- "description": "Secret scanning was enabled for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_push_protection.disable",
- "description": "Secret scanning push protection was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_secret_scanning_push_protection.enable",
- "description": "Secret scanning push protection was enabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "restrict_notification_delivery.disable",
- "description": "Email notification restrictions for an organization or enterprise were disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "restrict_notification_delivery.enable",
- "description": "Email notification restrictions for an organization or enterprise were enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "secret_scanning_alert.create",
- "description": "GitHub detected a secret and created a secret scanning alert.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
- },
- {
- "action": "secret_scanning_alert.reopen",
- "description": "A secret scanning alert was reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.resolve",
- "description": "A secret scanning alert was resolved.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.revoke",
- "description": "A secret scanning alert was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning.disable",
- "description": "Secret scanning was disabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning.enable",
- "description": "Secret scanning was enabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.disable",
- "description": "Secret scanning was disabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.enable",
- "description": "Secret scanning was enabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_push_protection.bypass",
- "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret"
- },
- {
- "action": "security_key.register",
- "description": "A security key was registered for an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "security_key.remove",
- "description": "A security key was removed from an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.sponsored_developer_update_newsletter_send",
- "description": "Triggered when you send an email update to your sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.waitlist_join",
- "description": "You join the waitlist to join GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ssh_certificate_authority.create",
- "description": "An SSH certificate authority for an organization or enterprise was created.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_authority.destroy",
- "description": "An SSH certificate authority for an organization or enterprise was deleted.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.disable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.enable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "staff.set_domain_token_expiration",
- "description": "The verification code expiry time for an organization or enterprise domain was set.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.unverify_domain",
- "description": "An organization or enterprise domain was unverified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.verify_domain",
- "description": "An organization or enterprise domain was verified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.accept",
- "description": "Triggered when you accept a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.cancel",
- "description": "Triggered when you cancel a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.create",
- "description": "Triggered when you create a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.decline",
- "description": "Triggered when you decline a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.revoke",
- "description": "Triggered when you revoke a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "team.add_member",
- "description": "A member of an organization was added to a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
- },
- {
- "action": "team.add_repository",
- "description": "A team was given access and permissions to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.change_parent_team",
- "description": "A child team was created or a child team's parent was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
- },
- {
- "action": "team.change_privacy",
- "description": "A team's privacy level was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility"
- },
- {
- "action": "team.create",
- "description": "A new team is created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.demote_maintainer",
- "description": "A user was demoted from a team maintainer to a team member.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
- },
- {
- "action": "team.destroy",
- "description": "A team was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization"
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.promote_maintainer",
- "description": "A user was promoted from a team member to a team maintainer.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
- },
- {
- "action": "team.remove_member",
- "description": "An organization member was removed from a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
- },
- {
- "action": "team.remove_repository",
- "description": "A repository was removed from a team's control.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.rename",
- "description": "A team's name was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_sync_tenant.disabled",
- "description": "Team synchronization with a tenant was disabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.enabled",
- "description": "Team synchronization with a tenant was enabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team.update_repository_permission",
- "description": "A team's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.register",
- "description": "A new trusted device was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.remove",
- "description": "A trusted device was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.abort",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.complete",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.ignore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_approve",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_decline",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.start",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.two_factor_destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.add_factor",
- "description": "A secondary authentication factor was added to a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.disabled",
- "description": "Two-factor authentication was disabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account"
- },
- {
- "action": "two_factor_authentication.enabled",
- "description": "Two-factor authentication was enabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.password_reset_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.recovery_codes_regenerated",
- "description": "Two factor recovery codes were regenerated for a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.remove_factor",
- "description": "A secondary authentication factor was removed from a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.sign_in_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.update_fallback",
- "description": "The two-factor authentication fallback for a user account was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.add_email",
- "description": "An email address was added to a user account.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account"
- },
- {
- "action": "user.async_delete",
- "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.audit_log_export",
- "description": "Audit log entries were exported.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.block_user",
- "description": "A user was blocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.change_password",
- "description": "A user changed their password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.codespaces_trusted_repo_access_granted",
- "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.codespaces_trusted_repo_access_revoked",
- "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.correct_password_from_unrecognized_device",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.correct_password_from_unrecognized_device_and_location",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.correct_password_from_unrecognized_location",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create",
- "description": "A new user account was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create_integration_secret",
- "description": "A user secret for Codespaces was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.creation_rate_limit_exceeded",
- "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.delete",
- "description": "A user account was destroyed by an asynchronous job.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.demote",
- "description": "A site administrator was demoted to an ordinary user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.destroy",
- "description": "A user deleted his or her account, triggering user.async_delete.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_failure",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_requested",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_success",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.failed_login",
- "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.flag_as_large_scale_contributor",
- "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.forgot_password",
- "description": "A user requested a password reset.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
- },
- {
- "action": "user.grant_github_developer",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.hide_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.login",
- "description": "A user signed in.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.logout",
- "description": "A user signed out.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.minimize_comment",
- "description": "A comment made by a user was minimized.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.new_device_used",
- "description": "A user signed in from a new device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.partial_two_factor_email_followup",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.promote",
- "description": "An ordinary user account was promoted to a site administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.recreate",
- "description": "A user's account was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_email",
- "description": "An email address was removed from a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_integration_secret",
- "description": "A user secret for Codespaces was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_large_scale_contributor_flag",
- "description": "A user account was no longer flagged as a large scale contributor.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.rename",
- "description": "A username was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.report_abuse",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.report_content",
- "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam"
- },
- {
- "action": "user.reset_password",
- "description": "A user reset their account password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_session.country_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.show_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.sign_in_from_unrecognized_device",
- "description": "A user signed in from an unrecognized device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_device_and_location",
- "description": "A user signed in from an unrecognized device and location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_location",
- "description": "A user signed in from an unrecognized location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.destroy",
- "description": "Triggered when you clear the status on your profile.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.update",
- "description": "Triggered when you set or change the status on your profile.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status"
- },
- {
- "action": "user.suspend",
- "description": "A user account was suspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.toggle_warn_private_email",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_failure",
- "description": "A 2FA challenge issued for a user account failed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_success",
- "description": "A 2FA challenge issued for a user account succeeded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recover",
- "description": "A user used their 2FA recovery codes.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_downloaded",
- "description": "A user downloaded 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_printed",
- "description": "A user printed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_viewed",
- "description": "A user viewed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_requested",
- "description": "A user was prompted for a two-factor authentication code.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
- },
- {
- "action": "user.unblock_user",
- "description": "A user was unblocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unminimize_comment",
- "description": "A comment made by a user was unminimized.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unsuspend",
- "description": "A user account was unsuspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_integration_secret",
- "description": "A user secret for Codespaces was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_new_repository_default_branch_setting",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.cancel_workflow_run",
- "description": "A workflow run was cancelled.",
- "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.completed_workflow_run",
- "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history"
- },
- {
- "action": "workflows.created_workflow_run",
- "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.prepared_workflow_job",
- "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.rerun_workflow_run",
- "description": "A workflow run was re-run.",
- "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.11/organization.json b/src/audit-logs/data/ghes-3.11/organization.json
deleted file mode 100644
index 0044e1828814..000000000000
--- a/src/audit-logs/data/ghes-3.11/organization.json
+++ /dev/null
@@ -1,3067 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.accept",
- "description": "Credit was accepted for a security advisory.",
- "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
- },
- {
- "action": "advisory_credit.create",
- "description": "Someone was added to the credit section of a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.decline",
- "description": "Credit was declined for a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.destroy",
- "description": "Someone was removed from the credit section of a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "auto_approve_personal_access_token_requests.disable",
- "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
- },
- {
- "action": "auto_approve_personal_access_token_requests.enable",
- "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.attempted_to_create_from_prebuild",
- "description": "An attempt to create a codespace from a prebuild was made.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.business_enablement_updated",
- "description": "Enterprise setting for Codespaces ownership was updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_created",
- "description": "Policies were applied to codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_deleted",
- "description": "Policies were removed from codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_updated",
- "description": "Policies were updated for codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "commit_comment.destroy",
- "description": "A commit comment was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "commit_comment.update",
- "description": "A commit comment was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_org_settings_changed",
- "description": "Copilot feature settings were changed at the organization level.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_added",
- "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_created",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
- "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business"
- },
- {
- "action": "copilot.cfb_seat_assignment_refreshed",
- "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_reused",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_unassigned",
- "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled_by_staff",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_management_changed",
- "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_comment.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_comment.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "enterprise_installation.create",
- "description": "The GitHub App associated with a GitHub Connect connection was created.",
- "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect"
- },
- {
- "action": "enterprise_installation.destroy",
- "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
- "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "git.clone",
- "description": "A repository was cloned.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.fetch",
- "description": "Changes were fetched from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.push",
- "description": "Changes were pushed to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation_request.close",
- "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
- "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
- },
- {
- "action": "integration_installation_request.create",
- "description": "A member requested that an owner install a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "ip_allow_list.disable",
- "description": "An IP allow list was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_for_installed_apps",
- "description": "An IP allow list was disabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable",
- "description": "An IP allow list was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_for_installed_apps",
- "description": "An IP allow list was enabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.create",
- "description": "An IP address was added to an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.destroy",
- "description": "An IP address was deleted from an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.update",
- "description": "An IP address or its description was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue_comment.destroy",
- "description": "A comment on an issue was deleted from the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue_comment.update",
- "description": "A comment on an issue (other than the initial one) changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue.destroy",
- "description": "An issue was deleted from the repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue"
- },
- {
- "action": "issue.pinned",
- "description": "An issue was pinned to a repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository"
- },
- {
- "action": "issue.transfer",
- "description": "An issue was transferred to another repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository"
- },
- {
- "action": "issue.unpinned",
- "description": "An issue was unpinned from a repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository"
- },
- {
- "action": "issues.deletes_disabled",
- "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "issues.deletes_enabled",
- "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "issues.deletes_policy_cleared",
- "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "members_can_create_pages.disable",
- "description": "The ability for members to publish GitHub Pages sites was disabled.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_pages.enable",
- "description": "The ability for members to publish GitHub Pages sites was enabled.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_private_pages.disable",
- "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_private_pages.enable",
- "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_public_pages.disable",
- "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_public_pages.enable",
- "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_delete_repos.clear",
- "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_delete_repos.disable",
- "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_delete_repos.enable",
- "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_view_dependency_insights.clear",
- "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "members_can_view_dependency_insights.disable",
- "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise"
- },
- {
- "action": "members_can_view_dependency_insights.enable",
- "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.destroy_file",
- "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.download",
- "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "org.accept_business_invitation",
- "description": "An invitation sent to an organization to join an enterprise was accepted.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.add_billing_manager",
- "description": "A billing manager was added to an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_policy_selected_member_disabled",
- "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.advanced_security_policy_selected_member_enabled",
- "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled",
- "description": "Third-party application access for outside collaborators was disabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
- },
- {
- "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
- "description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
- },
- {
- "action": "org.archive",
- "description": "The organization was archived.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.audit_log_export",
- "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
- },
- {
- "action": "org.audit_log_git_event_export",
- "description": "An export of the organization's Git events was created.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
- },
- {
- "action": "org.billing_signup_error",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.block_user",
- "description": "An organization owner blocked a user from accessing the organization's repositories.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
- },
- {
- "action": "org.cancel_business_invitation",
- "description": "An invitation for an organization to join an enterprise was revoked",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.cancel_invitation",
- "description": "An invitation sent to a user to join an organization was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.clear_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codespaces_access_updated",
- "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
- },
- {
- "action": "org.codespaces_ownership_updated",
- "description": "Ownership and payment for codespaces was updated for an organization.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
- },
- {
- "action": "org.codespaces_team_access_allowed",
- "description": "A team has been allowed to use Codespaces for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codespaces_team_access_revoked",
- "description": "A team has been prevented from using Codespaces for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codespaces_trusted_repo_access_granted",
- "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "org.codespaces_trusted_repo_access_revoked",
- "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "org.codespaces_user_access_allowed",
- "description": "A user has been allowed to use Codespaces for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codespaces_user_access_revoked",
- "description": "A user has been prevented from using Codespaces for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.confirm_business_invitation",
- "description": "An invitation for an organization to join an enterprise was confirmed.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.connect_usage_metrics_export",
- "description": "Server statistics were exported for the organization.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics"
- },
- {
- "action": "org.create",
- "description": "An organization was created.",
- "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
- },
- {
- "action": "org.create_actions_secret",
- "description": "A GitHub Actions secret was created for an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.create_actions_variable",
- "description": "A GitHub Actions variable was created for an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org_credential_authorization.deauthorize",
- "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
- "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on"
- },
- {
- "action": "org_credential_authorization.grant",
- "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
- "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on"
- },
- {
- "action": "org_credential_authorization.revoke",
- "description": "An owner revoked authorized credentials.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization"
- },
- {
- "action": "org.disable_member_team_creation_permission",
- "description": "Team creation was limited to owners.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.disable_oauth_app_restrictions",
- "description": "Third-party application access restrictions for an organization were disabled.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
- },
- {
- "action": "org.disable_reader_discussion_creation_permission",
- "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.disable_saml",
- "description": "SAML single sign-on was disabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the organization was disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
- },
- {
- "action": "org.disable_two_factor_requirement",
- "description": "A two-factor authentication requirement was disabled for the organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_disabled",
- "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_enabled",
- "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.enable_member_team_creation_permission",
- "description": "Team creation by members was allowed.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.enable_oauth_app_restrictions",
- "description": "Third-party application access restrictions for an organization were enabled.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
- },
- {
- "action": "org.enable_reader_discussion_creation_permission",
- "description": "An organization owner allowed users with read access to create discussions in an organization",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.enable_saml",
- "description": "SAML single sign-on was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization"
- },
- {
- "action": "org.enable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the organization was enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
- },
- {
- "action": "org.enable_two_factor_requirement",
- "description": "Two-factor authentication is now required for the organization.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.integration_manager_added",
- "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.integration_manager_removed",
- "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.invite_member",
- "description": "A new user was invited to join an organization.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
- },
- {
- "action": "org.invite_to_business",
- "description": "An organization was invited to join an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.oauth_app_access_approved",
- "description": "Access to an organization was granted for an OAuth App.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
- },
- {
- "action": "org.oauth_app_access_blocked",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.oauth_app_access_denied",
- "description": "Access was disabled for an OAuth App that was previously approved.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
- },
- {
- "action": "org.oauth_app_access_requested",
- "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.oauth_app_access_unblocked",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.rate_limited_invites",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization"
- },
- {
- "action": "org.remove_actions_secret",
- "description": "A GitHub Actions secret was removed from an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.remove_actions_variable",
- "description": "A GitHub Actions variable was removed from an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.remove_billing_manager",
- "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was removed from an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_outside_collaborator",
- "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization"
- },
- {
- "action": "org.rename",
- "description": "An organization was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.required_workflow_create",
- "description": "Triggered when a required workflow is created.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.required_workflow_delete",
- "description": "Triggered when a required workflow is deleted.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.required_workflow_update",
- "description": "Triggered when a required workflow is updated.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.restore_member",
- "description": "An organization member was restored.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
- },
- {
- "action": "org.revoke_external_identity",
- "description": "A member's linked identity was revoked.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity"
- },
- {
- "action": "org.revoke_sso_session",
- "description": "A member's SAML session was revoked.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity"
- },
- {
- "action": "org.runner_group_created",
- "description": "A self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org.runner_group_removed",
- "description": "A self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_renamed",
- "description": "A self-hosted runner group was renamed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_runner_removed",
- "description": "The REST API was used to remove a self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_runners_added",
- "description": "A self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "org.runner_group_runners_updated",
- "description": "A runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_updated",
- "description": "The configuration of a self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_visiblity_updated",
- "description": "The visibility of a self-hosted runner group was updated via the REST API.",
- "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the organization level",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
- },
- {
- "action": "org_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the organization level",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "org_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "org_secret_scanning_generic_secrets.disabled",
- "description": "Generic secrets have been disabled at the organization level",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org_secret_scanning_generic_secrets.enabled",
- "description": "Generic secrets have been enabled at the organization level",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_disabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_enabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_updated",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_disable",
- "description": "Push protection for secret scanning was disabled.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "org.secret_scanning_push_protection_enable",
- "description": "Push protection for secret scanning was enabled.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_disable",
- "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_enable",
- "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.transfer",
- "description": "An organization was transferred between enterprise accounts.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts"
- },
- {
- "action": "org.transfer_outgoing",
- "description": "An organization was transferred between enterprise accounts.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts"
- },
- {
- "action": "org.unarchive",
- "description": "The organization was unarchived.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.unblock_user",
- "description": "A user was unblocked from an organization.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
- },
- {
- "action": "org.update_actions_secret",
- "description": "A GitHub Actions secret was updated for an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.update_actions_settings",
- "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
- },
- {
- "action": "org.update_actions_variable",
- "description": "A GitHub Actions variable was updated for an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.update_default_repository_permission",
- "description": "The default repository permission level for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "org.update_new_repository_default_branch_setting",
- "description": "The name of the default branch was changed for new repositories in the organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
- },
- {
- "action": "org.update_repo_self_hosted_runners_policy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_saml_provider_settings",
- "description": "An organization's SAML provider settings were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_terms_of_service",
- "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
- "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
- },
- {
- "action": "organization_default_label.create",
- "description": "A default label was created for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
- },
- {
- "action": "organization_default_label.destroy",
- "description": "A default label was deleted for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
- },
- {
- "action": "organization_default_label.update",
- "description": "A default label was edited for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
- },
- {
- "action": "organization_domain.approve",
- "description": "A domain was approved for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.create",
- "description": "A domain was added to an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.destroy",
- "description": "A domain was removed from an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain"
- },
- {
- "action": "organization_domain.verify",
- "description": "A domain was verified for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_moderators.add_team",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.add_user",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.remove_team",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.remove_user",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_projects_change.clear",
- "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "organization_projects_change.disable",
- "description": "Organization projects were disabled for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "organization_projects_change.enable",
- "description": "Organization projects were enabled for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "organization_role.create",
- "description": "A custom organization role was created in an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles"
- },
- {
- "action": "organization_role.destroy",
- "description": "A custom organization role was deleted in an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles"
- },
- {
- "action": "organization_role.update",
- "description": "A custom organization role was edited in an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles"
- },
- {
- "action": "packages.package_deleted",
- "description": "An entire package was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_published",
- "description": "A package was published or republished to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "packages.package_version_deleted",
- "description": "A specific package version was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_version_published",
- "description": "A specific package version was published or republished to a package.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "prebuild_configuration.create",
- "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.destroy",
- "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.run_triggered",
- "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.update",
- "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.clear",
- "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.disable",
- "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.enable",
- "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.authorized_users_teams",
- "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
- },
- {
- "action": "protected_branch.branch_allowances",
- "description": "A protected branch allowance was given to a specific user, team or integration.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.create",
- "description": "Branch protection was enabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.destroy",
- "description": "Branch protection was disabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismiss_stale_reviews",
- "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismissal_restricted_users_teams",
- "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.policy_override",
- "description": "A branch protection requirement was overridden by a repository administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.rejected_ref_update",
- "description": "A branch update attempt was rejected.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_admin_enforced",
- "description": "Branch protection was enforced for repository administrators.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_deletions_enforcement_level",
- "description": "Branch deletion was enabled or disabled for a protected branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_force_pushes_enforcement_level",
- "description": "Force pushes were enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_ignore_approvals_from_contributors",
- "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "protected_branch.update_linear_history_requirement_enforcement_level",
- "description": "Required linear commit history was enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_lock_allows_fetch_and_merge",
- "description": "Fork syncing was enabled or disabled for a read-only branch",
- "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_lock_branch_enforcement_level",
- "description": "The enforcement of a branch lock was updated.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "protected_branch.update_name",
- "description": "A branch name pattern was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_pull_request_reviews_enforcement_level",
- "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_code_owner_review",
- "description": "Enforcement of required code owner review was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_last_push_approval",
- "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
- },
- {
- "action": "protected_branch.update_required_approving_review_count",
- "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_required_status_checks_enforcement_level",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_signature_requirement_enforcement_level",
- "description": "Enforcement of required commit signing was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_strict_required_status_checks_policy",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "pull_request.close",
- "description": "A pull request was closed without being merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
- },
- {
- "action": "pull_request.converted_to_draft",
- "description": "A pull request was converted to a draft.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
- },
- {
- "action": "pull_request.create",
- "description": "A pull request was created.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request"
- },
- {
- "action": "pull_request.create_review_request",
- "description": "A review was requested on a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.in_progress",
- "description": "A pull request was marked as in progress.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.indirect_merge",
- "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.merge",
- "description": "A pull request was merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
- },
- {
- "action": "pull_request.ready_for_review",
- "description": "A pull request was marked as ready for review.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
- },
- {
- "action": "pull_request.rebase",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.remove_review_request",
- "description": "A review request was removed from a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.reopen",
- "description": "A pull request was reopened after previously being closed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.create",
- "description": "A review comment was added to a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request_review_comment.delete",
- "description": "A review comment on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.update",
- "description": "A review comment on a pull request was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.delete",
- "description": "A review on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.dismiss",
- "description": "A review on a pull request was dismissed.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
- },
- {
- "action": "pull_request_review.submit",
- "description": "A review on a pull request was submitted.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codespaces_trusted_repo_access_granted",
- "description": "GitHub Codespaces was granted trusted repository access to this repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.codespaces_trusted_repo_access_revoked",
- "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.download_zip",
- "description": "A source code archive of a repository was downloaded as a ZIP file.",
- "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.rename_branch",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.close",
- "description": "Someone closed a security advisory.",
- "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
- },
- {
- "action": "repository_advisory.cve_request",
- "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.github_broadcast",
- "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.github_withdraw",
- "description": "GitHub withdrew a security advisory that was published in error.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.open",
- "description": "Someone opened a draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.publish",
- "description": "Someone published a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.reopen",
- "description": "Someone reopened as draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.update",
- "description": "Someone edited a draft or published security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_branch_protection_evaluation.disable",
- "description": "Branch protections were disabled for the repository.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "repository_branch_protection_evaluation.enable",
- "description": "Branch protections were enabled for this repository.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "repository_content_analysis.disable",
- "description": "Data use settings were disabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_content_analysis.enable",
- "description": "Data use settings were enabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_dependency_graph.disable",
- "description": "The dependency graph was disabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_dependency_graph.enable",
- "description": "The dependency graph was enabled for a private repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_projects_change.clear",
- "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise"
- },
- {
- "action": "repository_projects_change.disable",
- "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_projects_change.enable",
- "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_ruleset.create",
- "description": "A repository ruleset was created.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
- },
- {
- "action": "repository_ruleset.destroy",
- "description": "A repository ruleset was deleted.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
- },
- {
- "action": "repository_ruleset.update",
- "description": "A repository ruleset was edited.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
- },
- {
- "action": "repository_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the repository level",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
- },
- {
- "action": "repository_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the repository level",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning.disable",
- "description": "Secret scanning was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "repository_secret_scanning.enable",
- "description": "Secret scanning was enabled for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_generic_secrets.disabled",
- "description": "Generic secrets have been disabled at the repository level",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_generic_secrets.enabled",
- "description": "Generic secrets have been enabled at the repository level",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_push_protection.disable",
- "description": "Secret scanning push protection was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_secret_scanning_push_protection.enable",
- "description": "Secret scanning push protection was enabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_visibility_change.clear",
- "description": "The repository visibility change setting was cleared for an organization or enterprise.",
- "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility"
- },
- {
- "action": "repository_visibility_change.disable",
- "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_visibility_change.enable",
- "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.auto_dismiss",
- "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts"
- },
- {
- "action": "repository_vulnerability_alert.auto_reopen",
- "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts"
- },
- {
- "action": "repository_vulnerability_alert.create",
- "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
- },
- {
- "action": "repository_vulnerability_alert.dismiss",
- "description": "A Dependabot alert was manually dismissed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.reintroduce",
- "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.reopen",
- "description": "A Dependabot alert was manually reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.resolve",
- "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.authorized_users_teams",
- "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
- },
- {
- "action": "repository_vulnerability_alerts_auto_dismissal.disable",
- "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts_auto_dismissal.enable",
- "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.disable",
- "description": "Dependabot alerts was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.enable",
- "description": "Dependabot alerts was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "required_status_check.create",
- "description": "A status check was marked as required for a protected branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
- },
- {
- "action": "required_status_check.destroy",
- "description": "A status check was no longer marked as required for a protected branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
- },
- {
- "action": "restrict_notification_delivery.disable",
- "description": "Email notification restrictions for an organization or enterprise were disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "restrict_notification_delivery.enable",
- "description": "Email notification restrictions for an organization or enterprise were enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "role.create",
- "description": "A new custom repository role was created.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "role.destroy",
- "description": "A custom repository role was deleted.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "role.update",
- "description": "A custom repository role was edited.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "secret_scanning_alert.create",
- "description": "GitHub detected a secret and created a secret scanning alert.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
- },
- {
- "action": "secret_scanning_alert.reopen",
- "description": "A secret scanning alert was reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.resolve",
- "description": "A secret scanning alert was resolved.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.revoke",
- "description": "A secret scanning alert was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning.disable",
- "description": "Secret scanning was disabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning.enable",
- "description": "Secret scanning was enabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.disable",
- "description": "Secret scanning was disabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.enable",
- "description": "Secret scanning was enabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_push_protection.bypass",
- "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.invoiced_agreement_sign",
- "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ssh_certificate_authority.create",
- "description": "An SSH certificate authority for an organization or enterprise was created.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_authority.destroy",
- "description": "An SSH certificate authority for an organization or enterprise was deleted.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.disable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.enable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.set_domain_token_expiration",
- "description": "The verification code expiry time for an organization or enterprise domain was set.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.unverify_domain",
- "description": "An organization or enterprise domain was unverified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.verify_domain",
- "description": "An organization or enterprise domain was verified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.add_member",
- "description": "A member of an organization was added to a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
- },
- {
- "action": "team.add_repository",
- "description": "A team was given access and permissions to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.change_parent_team",
- "description": "A child team was created or a child team's parent was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
- },
- {
- "action": "team.change_privacy",
- "description": "A team's privacy level was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility"
- },
- {
- "action": "team.create",
- "description": "A new team is created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.demote_maintainer",
- "description": "A user was demoted from a team maintainer to a team member.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
- },
- {
- "action": "team.destroy",
- "description": "A team was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization"
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.promote_maintainer",
- "description": "A user was promoted from a team member to a team maintainer.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
- },
- {
- "action": "team.remove_member",
- "description": "An organization member was removed from a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
- },
- {
- "action": "team.remove_repository",
- "description": "A repository was removed from a team's control.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.rename",
- "description": "A team's name was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_sync_tenant.disabled",
- "description": "Team synchronization with a tenant was disabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.enabled",
- "description": "Team synchronization with a tenant was enabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.update_okta_credentials",
- "description": "The Okta credentials for team synchronization with a tenant were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.update_repository_permission",
- "description": "A team's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.create",
- "description": "A Dependabot rule was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.delete",
- "description": "A Dependabot rule was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.disable",
- "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.enable",
- "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.update",
- "description": "A Dependabot rule's conditions, actions, or metadata changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.cancel_workflow_run",
- "description": "A workflow run was cancelled.",
- "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.completed_workflow_run",
- "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history"
- },
- {
- "action": "workflows.created_workflow_run",
- "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.prepared_workflow_job",
- "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.rerun_workflow_run",
- "description": "A workflow run was re-run.",
- "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.11/user.json b/src/audit-logs/data/ghes-3.11/user.json
deleted file mode 100644
index 4be67b96841b..000000000000
--- a/src/audit-logs/data/ghes-3.11/user.json
+++ /dev/null
@@ -1,1832 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "account_recovery_token.confirm",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.recover",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.update_bill_cycle_day",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.set_actions_fork_pr_approvals_policy",
- "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories"
- },
- {
- "action": "business.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise"
- },
- {
- "action": "business.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise"
- },
- {
- "action": "business.set_fork_pr_workflows_policy",
- "description": "The policy for fork pull request workflows was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "copilot.cfb_seat_added",
- "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_created",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
- "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business"
- },
- {
- "action": "copilot.cfb_seat_assignment_refreshed",
- "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_reused",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_unassigned",
- "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled_by_staff",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "gist.create",
- "description": "A gist was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gist.destroy",
- "description": "A gist was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gist.visibility_change",
- "description": "The visibility of a gist was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git_signing_ssh_public_key.create",
- "description": "An SSH key was added to a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "git_signing_ssh_public_key.delete",
- "description": "An SSH key was removed from a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.publish",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.retire",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.create",
- "description": "An OAuth access token was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token"
- },
- {
- "action": "oauth_access.destroy",
- "description": "An OAuth access token was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_access.regenerate",
- "description": "An OAuth access token was regenerated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.update",
- "description": "An OAuth access token was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_authorization.create",
- "description": "An authorization for an OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_authorization.destroy",
- "description": "An authorization for an OAuth application was deleted.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "passkey.register",
- "description": "A new passkey was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "passkey.remove",
- "description": "A new passkey was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.create",
- "description": "Triggered when you create a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_regenerated",
- "description": "Triggered when you regenerate a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_revoked",
- "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
- "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users"
- },
- {
- "action": "personal_access_token.destroy",
- "description": "Triggered when you delete a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.update",
- "description": "A fine-grained personal access token was updated.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.temporary_access_granted",
- "description": "Temporary access was enabled for a repository.",
- "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_ruleset.create",
- "description": "A repository ruleset was created.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
- },
- {
- "action": "repository_ruleset.destroy",
- "description": "A repository ruleset was deleted.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
- },
- {
- "action": "repository_ruleset.update",
- "description": "A repository ruleset was edited.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
- },
- {
- "action": "security_key.register",
- "description": "A security key was registered for an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "security_key.remove",
- "description": "A security key was removed from an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.sponsored_developer_update_newsletter_send",
- "description": "Triggered when you send an email update to your sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.waitlist_join",
- "description": "You join the waitlist to join GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.accept",
- "description": "Triggered when you accept a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.cancel",
- "description": "Triggered when you cancel a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.create",
- "description": "Triggered when you create a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.decline",
- "description": "Triggered when you decline a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.revoke",
- "description": "Triggered when you revoke a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "trusted_device.register",
- "description": "A new trusted device was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.remove",
- "description": "A trusted device was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.abort",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.complete",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.ignore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_approve",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_decline",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.start",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.two_factor_destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.add_factor",
- "description": "A secondary authentication factor was added to a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.disabled",
- "description": "Two-factor authentication was disabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account"
- },
- {
- "action": "two_factor_authentication.enabled",
- "description": "Two-factor authentication was enabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.password_reset_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.recovery_codes_regenerated",
- "description": "Two factor recovery codes were regenerated for a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.remove_factor",
- "description": "A secondary authentication factor was removed from a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.sign_in_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.update_fallback",
- "description": "The two-factor authentication fallback for a user account was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.add_email",
- "description": "An email address was added to a user account.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account"
- },
- {
- "action": "user.async_delete",
- "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.audit_log_export",
- "description": "Audit log entries were exported.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.block_user",
- "description": "A user was blocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.change_password",
- "description": "A user changed their password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.codespaces_trusted_repo_access_granted",
- "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.codespaces_trusted_repo_access_revoked",
- "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.create",
- "description": "A new user account was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create_integration_secret",
- "description": "A user secret for Codespaces was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.creation_rate_limit_exceeded",
- "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.delete",
- "description": "A user account was destroyed by an asynchronous job.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.demote",
- "description": "A site administrator was demoted to an ordinary user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.destroy",
- "description": "A user deleted his or her account, triggering user.async_delete.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_failure",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_requested",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_success",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.failed_login",
- "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.forgot_password",
- "description": "A user requested a password reset.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
- },
- {
- "action": "user.grant_github_developer",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.hide_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.login",
- "description": "A user signed in.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.logout",
- "description": "A user signed out.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.new_device_used",
- "description": "A user signed in from a new device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.promote",
- "description": "An ordinary user account was promoted to a site administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.recreate",
- "description": "A user's account was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_email",
- "description": "An email address was removed from a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_integration_secret",
- "description": "A user secret for Codespaces was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.rename",
- "description": "A username was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.reset_password",
- "description": "A user reset their account password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_session.country_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.show_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.sign_in_from_unrecognized_device",
- "description": "A user signed in from an unrecognized device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_device_and_location",
- "description": "A user signed in from an unrecognized device and location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.destroy",
- "description": "Triggered when you clear the status on your profile.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.update",
- "description": "Triggered when you set or change the status on your profile.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status"
- },
- {
- "action": "user.suspend",
- "description": "A user account was suspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.toggle_warn_private_email",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_failure",
- "description": "A 2FA challenge issued for a user account failed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_success",
- "description": "A 2FA challenge issued for a user account succeeded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recover",
- "description": "A user used their 2FA recovery codes.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_downloaded",
- "description": "A user downloaded 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_printed",
- "description": "A user printed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_viewed",
- "description": "A user viewed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_requested",
- "description": "A user was prompted for a two-factor authentication code.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
- },
- {
- "action": "user.unblock_user",
- "description": "A user was unblocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unsuspend",
- "description": "A user account was unsuspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_integration_secret",
- "description": "A user secret for Codespaces was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_new_repository_default_branch_setting",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.12/enterprise.json b/src/audit-logs/data/ghes-3.12/enterprise.json
deleted file mode 100644
index 57e0dbe0f05d..000000000000
--- a/src/audit-logs/data/ghes-3.12/enterprise.json
+++ /dev/null
@@ -1,3382 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "account_recovery_token.confirm",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.recover",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "api.request",
- "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.check",
- "description": "A manual check of the endpoint configured for audit log streaming was performed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.create",
- "description": "An endpoint was added for audit log streaming.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.destroy",
- "description": "An audit log streaming endpoint was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.update",
- "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.update_bill_cycle_day",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.add_admin",
- "description": "An enterprise owner was added to an enterprise.",
- "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise"
- },
- {
- "action": "business.add_organization",
- "description": "An organization was added to an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_advanced_security.disabled",
- "description": "GitHub Advanced Security was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.enabled",
- "description": "GitHub Advanced Security was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business.advanced_security_policy_update",
- "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise"
- },
- {
- "action": "business.advanced_security_repo_admin_enablement_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.clear_actions_settings",
- "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise"
- },
- {
- "action": "business.clear_default_repository_permission",
- "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions"
- },
- {
- "action": "business.clear_members_can_create_repos",
- "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation"
- },
- {
- "action": "business.create",
- "description": "An enterprise was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.dependabot_alerts_repo_admin_enablement_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.disable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise"
- },
- {
- "action": "business.disable_two_factor_requirement",
- "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.enable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise"
- },
- {
- "action": "business.enable_two_factor_requirement",
- "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.clear",
- "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.remove_admin",
- "description": "An enterprise owner was removed from an enterprise.",
- "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise"
- },
- {
- "action": "business.remove_organization",
- "description": "An organization was removed from an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.rename_slug",
- "description": "The slug for the enterprise URL was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the business level",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features"
- },
- {
- "action": "business_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the business level",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features"
- },
- {
- "action": "business_secret_scanning_custom_pattern.create",
- "description": "An enterprise-level custom pattern was created for secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern.delete",
- "description": "An enterprise-level custom pattern was removed from secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_custom_pattern.publish",
- "description": "An enterprise-level custom pattern was published for secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern.update",
- "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning.disable",
- "description": "Secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.disabled_for_new_repos",
- "description": "Secret scanning was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.enable",
- "description": "Secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.enabled_for_new_repos",
- "description": "Secret scanning was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.disable",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.enable",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.update",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.disable",
- "description": "Push protection for secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.disabled_for_new_repos",
- "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.enable",
- "description": "Push protection for secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.enabled_for_new_repos",
- "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business.secret_scanning_repo_admin_settings_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.set_actions_fork_pr_approvals_policy",
- "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories"
- },
- {
- "action": "business.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise"
- },
- {
- "action": "business.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise"
- },
- {
- "action": "business.set_fork_pr_workflows_policy",
- "description": "The policy for fork pull request workflows was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "business.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.update_actions_settings",
- "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise"
- },
- {
- "action": "business.update_default_repository_permission",
- "description": "The base repository permission setting was updated for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions"
- },
- {
- "action": "business.update_member_repository_creation_permission",
- "description": "The repository creation setting was updated for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation"
- },
- {
- "action": "business.update_member_repository_invitation_permission",
- "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "copilot.cfb_seat_added",
- "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_created",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
- "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business"
- },
- {
- "action": "copilot.cfb_seat_assignment_refreshed",
- "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_reused",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_unassigned",
- "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled_by_staff",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_property_definition.create",
- "description": "A new custom property definition was created.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_definition.destroy",
- "description": "A custom property definition was deleted.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_definition.update",
- "description": "A custom property definition was updated.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_value.create",
- "description": "A repository's custom property value was manually set for the first time.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_value.destroy",
- "description": "A repository's custom property value was deleted.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_value.update",
- "description": "A repository's custom property value was updated.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "enterprise_announcement.create",
- "description": "A global announcement banner was created for the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner"
- },
- {
- "action": "enterprise_announcement.destroy",
- "description": "A global announcement banner was removed from the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise"
- },
- {
- "action": "enterprise_announcement.update",
- "description": "A global announcement banner was updated for the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise"
- },
- {
- "action": "enterprise.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "enterprise_domain.approve",
- "description": "A domain was approved for an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise_domain.create",
- "description": "A domain was added to an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise_domain.destroy",
- "description": "A domain was removed from an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain"
- },
- {
- "action": "enterprise_domain.verify",
- "description": "A domain was verified for an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise.register_self_hosted_runner",
- "description": "A new GitHub Actions self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "enterprise.remove_self_hosted_runner",
- "description": "A GitHub Actions self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "enterprise.runner_group_created",
- "description": "A GitHub Actions self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "enterprise.runner_group_removed",
- "description": "A GitHub Actions self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "enterprise.runner_group_runner_removed",
- "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "enterprise.runner_group_runners_added",
- "description": "A GitHub Actions self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "enterprise.runner_group_runners_updated",
- "description": "A GitHub Actions runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "enterprise.runner_group_updated",
- "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "enterprise.self_hosted_runner_offline",
- "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "enterprise.self_hosted_runner_online",
- "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "enterprise.self_hosted_runner_updated",
- "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "gist.create",
- "description": "A gist was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gist.destroy",
- "description": "A gist was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gist.visibility_change",
- "description": "The visibility of a gist was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.clone",
- "description": "A repository was cloned.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.fetch",
- "description": "Changes were fetched from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.push",
- "description": "Changes were pushed to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git_signing_ssh_public_key.create",
- "description": "An SSH key was added to a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "git_signing_ssh_public_key.delete",
- "description": "An SSH key was removed from a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "ip_allow_list.disable",
- "description": "An IP allow list was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_for_installed_apps",
- "description": "An IP allow list was disabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_user_level_enforcement",
- "description": "IP allow list user level enforcement was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable",
- "description": "An IP allow list was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_for_installed_apps",
- "description": "An IP allow list was enabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_user_level_enforcement",
- "description": "IP allow list user level enforcement was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.create",
- "description": "An IP address was added to an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.destroy",
- "description": "An IP address was deleted from an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.update",
- "description": "An IP address or its description was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.publish",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.retire",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.create",
- "description": "An OAuth access token was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token"
- },
- {
- "action": "oauth_access.destroy",
- "description": "An OAuth access token was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_access.regenerate",
- "description": "An OAuth access token was regenerated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.update",
- "description": "An OAuth access token was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.suspend",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.unsuspend",
- "description": "An OAuth application was unsuspended for a user or organization account.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_authorization.create",
- "description": "An authorization for an OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_authorization.destroy",
- "description": "An authorization for an OAuth application was deleted.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations"
- },
- {
- "action": "oauth_authorization.update",
- "description": "An authorization for an OAuth application was updated.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "org.accept_business_invitation",
- "description": "An invitation sent to an organization to join an enterprise was accepted.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.add_billing_manager",
- "description": "A billing manager was added to an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_policy_selected_member_disabled",
- "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.advanced_security_policy_selected_member_enabled",
- "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.async_delete",
- "description": "A user initiated a background job to delete an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.audit_log_export",
- "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
- },
- {
- "action": "org.billing_signup_error",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.block_user",
- "description": "An organization owner blocked a user from accessing the organization's repositories.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
- },
- {
- "action": "org.cancel_business_invitation",
- "description": "An invitation for an organization to join an enterprise was revoked",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.cancel_invitation",
- "description": "An invitation sent to a user to join an organization was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.clear_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.confirm_business_invitation",
- "description": "An invitation for an organization to join an enterprise was confirmed.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.create",
- "description": "An organization was created.",
- "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
- },
- {
- "action": "org.delete",
- "description": "An organization was deleted by a user or staff.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_member_team_creation_permission",
- "description": "Team creation was limited to owners.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.disable_reader_discussion_creation_permission",
- "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.disable_saml",
- "description": "SAML single sign-on was disabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_two_factor_requirement",
- "description": "A two-factor authentication requirement was disabled for the organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_disabled",
- "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_enabled",
- "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.enable_member_team_creation_permission",
- "description": "Team creation by members was allowed.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.enable_reader_discussion_creation_permission",
- "description": "An organization owner allowed users with read access to create discussions in an organization",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.enable_saml",
- "description": "SAML single sign-on was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization"
- },
- {
- "action": "org.enable_two_factor_requirement",
- "description": "Two-factor authentication is now required for the organization.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.integration_manager_added",
- "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.integration_manager_removed",
- "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.invite_member",
- "description": "A new user was invited to join an organization.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
- },
- {
- "action": "org.invite_to_business",
- "description": "An organization was invited to join an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.rate_limited_invites",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.recreate",
- "description": "An organization was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization"
- },
- {
- "action": "org.remove_billing_manager",
- "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_outside_collaborator",
- "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization"
- },
- {
- "action": "org.rename",
- "description": "An organization was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.restore_member",
- "description": "An organization member was restored.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
- },
- {
- "action": "org.runner_group_created",
- "description": "A self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org.runner_group_removed",
- "description": "A self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_runner_removed",
- "description": "The REST API was used to remove a self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_runners_added",
- "description": "A self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "org.runner_group_runners_updated",
- "description": "A runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_updated",
- "description": "The configuration of a self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the organization level",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
- },
- {
- "action": "org_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the organization level",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "org_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_disabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_enabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_updated",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_disable",
- "description": "Push protection for secret scanning was disabled.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "org.secret_scanning_push_protection_enable",
- "description": "Push protection for secret scanning was enabled.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_disable",
- "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_enable",
- "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.transform",
- "description": "A user account was converted into an organization.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization"
- },
- {
- "action": "org.unblock_user",
- "description": "A user was unblocked from an organization.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
- },
- {
- "action": "org.update_actions_settings",
- "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
- },
- {
- "action": "org.update_default_repository_permission",
- "description": "The default repository permission level for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "org.update_saml_provider_settings",
- "description": "An organization's SAML provider settings were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_terms_of_service",
- "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
- "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
- },
- {
- "action": "organization_domain.approve",
- "description": "A domain was approved for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.create",
- "description": "A domain was added to an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.destroy",
- "description": "A domain was removed from an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain"
- },
- {
- "action": "organization_domain.verify",
- "description": "A domain was verified for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "packages.package_deleted",
- "description": "An entire package was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_published",
- "description": "A package was published or republished to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "packages.package_version_deleted",
- "description": "A specific package version was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_version_published",
- "description": "A specific package version was published or republished to a package.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "passkey.register",
- "description": "A new passkey was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "passkey.remove",
- "description": "A new passkey was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.create",
- "description": "Triggered when you create a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_regenerated",
- "description": "Triggered when you regenerate a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_revoked",
- "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
- "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users"
- },
- {
- "action": "personal_access_token.destroy",
- "description": "Triggered when you delete a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.update",
- "description": "A fine-grained personal access token was updated.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.authorized_users_teams",
- "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
- },
- {
- "action": "protected_branch.branch_allowances",
- "description": "A protected branch allowance was given to a specific user, team or integration.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.create",
- "description": "Branch protection was enabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.destroy",
- "description": "Branch protection was disabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismiss_stale_reviews",
- "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismissal_restricted_users_teams",
- "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.policy_override",
- "description": "A branch protection requirement was overridden by a repository administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.rejected_ref_update",
- "description": "A branch update attempt was rejected.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_admin_enforced",
- "description": "Branch protection was enforced for repository administrators.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_deletions_enforcement_level",
- "description": "Branch deletion was enabled or disabled for a protected branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_force_pushes_enforcement_level",
- "description": "Force pushes were enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_ignore_approvals_from_contributors",
- "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "protected_branch.update_linear_history_requirement_enforcement_level",
- "description": "Required linear commit history was enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_lock_allows_fetch_and_merge",
- "description": "Fork syncing was enabled or disabled for a read-only branch",
- "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_lock_branch_enforcement_level",
- "description": "The enforcement of a branch lock was updated.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "protected_branch.update_name",
- "description": "A branch name pattern was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_pull_request_reviews_enforcement_level",
- "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_code_owner_review",
- "description": "Enforcement of required code owner review was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_last_push_approval",
- "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
- },
- {
- "action": "protected_branch.update_required_approving_review_count",
- "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_required_status_checks_enforcement_level",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_signature_requirement_enforcement_level",
- "description": "Enforcement of required commit signing was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_strict_required_status_checks_policy",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "pull_request.close",
- "description": "A pull request was closed without being merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
- },
- {
- "action": "pull_request.converted_to_draft",
- "description": "A pull request was converted to a draft.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
- },
- {
- "action": "pull_request.create",
- "description": "A pull request was created.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request"
- },
- {
- "action": "pull_request.create_review_request",
- "description": "A review was requested on a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.in_progress",
- "description": "A pull request was marked as in progress.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.indirect_merge",
- "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.merge",
- "description": "A pull request was merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
- },
- {
- "action": "pull_request.ready_for_review",
- "description": "A pull request was marked as ready for review.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
- },
- {
- "action": "pull_request.rebase",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.remove_review_request",
- "description": "A review request was removed from a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.reopen",
- "description": "A pull request was reopened after previously being closed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.create",
- "description": "A review comment was added to a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request_review_comment.delete",
- "description": "A review comment on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.update",
- "description": "A review comment on a pull request was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.delete",
- "description": "A review on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.dismiss",
- "description": "A review on a pull request was dismissed.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
- },
- {
- "action": "pull_request_review.submit",
- "description": "A review on a pull request was submitted.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.disk_archive",
- "description": "A repository was archived on disk.",
- "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories"
- },
- {
- "action": "repo.download_zip",
- "description": "A source code archive of a repository was downloaded as a ZIP file.",
- "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives"
- },
- {
- "action": "repo.hide_from_discovery",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.noindex",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.override_unlock",
- "description": "The repository was unlocked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_build",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_soft_delete",
- "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_soft_delete_restore",
- "description": "A GitHub Pages site that was previously soft-deleted was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.require_login",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.temporary_access_granted",
- "description": "Temporary access was enabled for a repository.",
- "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_branch_protection_evaluation.disable",
- "description": "Branch protections were disabled for the repository.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "repository_branch_protection_evaluation.enable",
- "description": "Branch protections were enabled for this repository.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_ruleset.create",
- "description": "A repository ruleset was created.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
- },
- {
- "action": "repository_ruleset.destroy",
- "description": "A repository ruleset was deleted.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
- },
- {
- "action": "repository_ruleset.update",
- "description": "A repository ruleset was edited.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
- },
- {
- "action": "repository_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the repository level",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
- },
- {
- "action": "repository_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the repository level",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning.disable",
- "description": "Secret scanning was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "repository_secret_scanning.enable",
- "description": "Secret scanning was enabled for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_push_protection.disable",
- "description": "Secret scanning push protection was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_secret_scanning_push_protection.enable",
- "description": "Secret scanning push protection was enabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "restrict_notification_delivery.disable",
- "description": "Email notification restrictions for an organization or enterprise were disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "restrict_notification_delivery.enable",
- "description": "Email notification restrictions for an organization or enterprise were enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "secret_scanning_alert.create",
- "description": "GitHub detected a secret and created a secret scanning alert.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
- },
- {
- "action": "secret_scanning_alert.reopen",
- "description": "A secret scanning alert was reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.resolve",
- "description": "A secret scanning alert was resolved.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.revoke",
- "description": "A secret scanning alert was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning.disable",
- "description": "Secret scanning was disabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning.enable",
- "description": "Secret scanning was enabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.disable",
- "description": "Secret scanning was disabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.enable",
- "description": "Secret scanning was enabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_push_protection.bypass",
- "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret"
- },
- {
- "action": "security_key.register",
- "description": "A security key was registered for an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "security_key.remove",
- "description": "A security key was removed from an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.sponsored_developer_update_newsletter_send",
- "description": "Triggered when you send an email update to your sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
- },
- {
- "action": "sponsors.sponsors_patreon_user_create",
- "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account"
- },
- {
- "action": "sponsors.sponsors_patreon_user_destroy",
- "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.waitlist_join",
- "description": "You join the waitlist to join GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ssh_certificate_authority.create",
- "description": "An SSH certificate authority for an organization or enterprise was created.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_authority.destroy",
- "description": "An SSH certificate authority for an organization or enterprise was deleted.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.disable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.enable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "staff.set_domain_token_expiration",
- "description": "The verification code expiry time for an organization or enterprise domain was set.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.unverify_domain",
- "description": "An organization or enterprise domain was unverified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.verify_domain",
- "description": "An organization or enterprise domain was verified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.accept",
- "description": "Triggered when you accept a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.cancel",
- "description": "Triggered when you cancel a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.create",
- "description": "Triggered when you create a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.decline",
- "description": "Triggered when you decline a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.revoke",
- "description": "Triggered when you revoke a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "team.add_member",
- "description": "A member of an organization was added to a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
- },
- {
- "action": "team.add_repository",
- "description": "A team was given access and permissions to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.change_parent_team",
- "description": "A child team was created or a child team's parent was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
- },
- {
- "action": "team.change_privacy",
- "description": "A team's privacy level was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility"
- },
- {
- "action": "team.create",
- "description": "A new team is created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.demote_maintainer",
- "description": "A user was demoted from a team maintainer to a team member.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
- },
- {
- "action": "team.destroy",
- "description": "A team was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization"
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.promote_maintainer",
- "description": "A user was promoted from a team member to a team maintainer.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
- },
- {
- "action": "team.remove_member",
- "description": "An organization member was removed from a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
- },
- {
- "action": "team.remove_repository",
- "description": "A repository was removed from a team's control.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.rename",
- "description": "A team's name was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_sync_tenant.disabled",
- "description": "Team synchronization with a tenant was disabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.enabled",
- "description": "Team synchronization with a tenant was enabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team.update_repository_permission",
- "description": "A team's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.register",
- "description": "A new trusted device was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.remove",
- "description": "A trusted device was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.abort",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.complete",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.ignore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_approve",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_decline",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.start",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.two_factor_destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.add_factor",
- "description": "A secondary authentication factor was added to a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.disabled",
- "description": "Two-factor authentication was disabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account"
- },
- {
- "action": "two_factor_authentication.enabled",
- "description": "Two-factor authentication was enabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.password_reset_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.recovery_codes_regenerated",
- "description": "Two factor recovery codes were regenerated for a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.remove_factor",
- "description": "A secondary authentication factor was removed from a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.sign_in_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.update_fallback",
- "description": "The two-factor authentication fallback for a user account was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.add_email",
- "description": "An email address was added to a user account.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account"
- },
- {
- "action": "user.async_delete",
- "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.audit_log_export",
- "description": "Audit log entries were exported.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.block_user",
- "description": "A user was blocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.change_password",
- "description": "A user changed their password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.codespaces_trusted_repo_access_granted",
- "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.codespaces_trusted_repo_access_revoked",
- "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.correct_password_from_unrecognized_device",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.correct_password_from_unrecognized_device_and_location",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.correct_password_from_unrecognized_location",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create",
- "description": "A new user account was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create_integration_secret",
- "description": "A user secret for Codespaces was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.creation_rate_limit_exceeded",
- "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.delete",
- "description": "A user account was destroyed by an asynchronous job.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.demote",
- "description": "A site administrator was demoted to an ordinary user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.destroy",
- "description": "A user deleted his or her account, triggering user.async_delete.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_failure",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_requested",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_success",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.failed_login",
- "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.flag_as_large_scale_contributor",
- "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.forgot_password",
- "description": "A user requested a password reset.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
- },
- {
- "action": "user.grant_github_developer",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.hide_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.login",
- "description": "A user signed in.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.logout",
- "description": "A user signed out.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.minimize_comment",
- "description": "A comment made by a user was minimized.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.new_device_used",
- "description": "A user signed in from a new device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.partial_two_factor_email_followup",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.promote",
- "description": "An ordinary user account was promoted to a site administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.recreate",
- "description": "A user's account was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_email",
- "description": "An email address was removed from a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_integration_secret",
- "description": "A user secret for Codespaces was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_large_scale_contributor_flag",
- "description": "A user account was no longer flagged as a large scale contributor.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.rename",
- "description": "A username was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.report_abuse",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.report_content",
- "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam"
- },
- {
- "action": "user.reset_password",
- "description": "A user reset their account password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_session.country_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.show_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.sign_in_from_unrecognized_device",
- "description": "A user signed in from an unrecognized device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_device_and_location",
- "description": "A user signed in from an unrecognized device and location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_location",
- "description": "A user signed in from an unrecognized location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.destroy",
- "description": "Triggered when you clear the status on your profile.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.update",
- "description": "Triggered when you set or change the status on your profile.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status"
- },
- {
- "action": "user.suspend",
- "description": "A user account was suspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.toggle_warn_private_email",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_failure",
- "description": "A 2FA challenge issued for a user account failed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_success",
- "description": "A 2FA challenge issued for a user account succeeded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recover",
- "description": "A user used their 2FA recovery codes.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_downloaded",
- "description": "A user downloaded 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_printed",
- "description": "A user printed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_viewed",
- "description": "A user viewed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_requested",
- "description": "A user was prompted for a two-factor authentication code.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
- },
- {
- "action": "user.unblock_user",
- "description": "A user was unblocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unminimize_comment",
- "description": "A comment made by a user was unminimized.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unsuspend",
- "description": "A user account was unsuspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_integration_secret",
- "description": "A user secret for Codespaces was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_new_repository_default_branch_setting",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.cancel_workflow_run",
- "description": "A workflow run was cancelled.",
- "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.completed_workflow_run",
- "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history"
- },
- {
- "action": "workflows.created_workflow_run",
- "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.prepared_workflow_job",
- "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.rerun_workflow_run",
- "description": "A workflow run was re-run.",
- "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.12/organization.json b/src/audit-logs/data/ghes-3.12/organization.json
deleted file mode 100644
index 7fbddd0eba62..000000000000
--- a/src/audit-logs/data/ghes-3.12/organization.json
+++ /dev/null
@@ -1,3172 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.accept",
- "description": "Credit was accepted for a security advisory.",
- "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
- },
- {
- "action": "advisory_credit.create",
- "description": "Someone was added to the credit section of a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.decline",
- "description": "Credit was declined for a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.destroy",
- "description": "Someone was removed from the credit section of a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "auto_approve_personal_access_token_requests.disable",
- "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
- },
- {
- "action": "auto_approve_personal_access_token_requests.enable",
- "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.attempted_to_create_from_prebuild",
- "description": "An attempt to create a codespace from a prebuild was made.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.business_enablement_updated",
- "description": "Enterprise setting for Codespaces ownership was updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_created",
- "description": "Policies were applied to codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_deleted",
- "description": "Policies were removed from codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_updated",
- "description": "Policies were updated for codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "commit_comment.destroy",
- "description": "A commit comment was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "commit_comment.update",
- "description": "A commit comment was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_org_settings_changed",
- "description": "Copilot feature settings were changed at the organization level.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_added",
- "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_created",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
- "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business"
- },
- {
- "action": "copilot.cfb_seat_assignment_refreshed",
- "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_reused",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_unassigned",
- "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled_by_staff",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_management_changed",
- "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.content_exclusion_changed",
- "description": "The excluded paths for GitHub Copilot were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_property_definition.create",
- "description": "A new custom property definition was created.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_definition.destroy",
- "description": "A custom property definition was deleted.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_definition.update",
- "description": "A custom property definition was updated.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_value.create",
- "description": "A repository's custom property value was manually set for the first time.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_value.destroy",
- "description": "A repository's custom property value was deleted.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_value.update",
- "description": "A repository's custom property value was updated.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_comment.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_comment.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "enterprise_installation.create",
- "description": "The GitHub App associated with a GitHub Connect connection was created.",
- "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect"
- },
- {
- "action": "enterprise_installation.destroy",
- "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
- "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "git.clone",
- "description": "A repository was cloned.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.fetch",
- "description": "Changes were fetched from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.push",
- "description": "Changes were pushed to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation_request.close",
- "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
- "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
- },
- {
- "action": "integration_installation_request.create",
- "description": "A member requested that an owner install a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "ip_allow_list.disable",
- "description": "An IP allow list was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_for_installed_apps",
- "description": "An IP allow list was disabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable",
- "description": "An IP allow list was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_for_installed_apps",
- "description": "An IP allow list was enabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.create",
- "description": "An IP address was added to an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.destroy",
- "description": "An IP address was deleted from an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.update",
- "description": "An IP address or its description was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue_comment.destroy",
- "description": "A comment on an issue was deleted from the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue_comment.update",
- "description": "A comment on an issue (other than the initial one) changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue.destroy",
- "description": "An issue was deleted from the repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue"
- },
- {
- "action": "issue.pinned",
- "description": "An issue was pinned to a repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository"
- },
- {
- "action": "issue.transfer",
- "description": "An issue was transferred to another repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository"
- },
- {
- "action": "issue.unpinned",
- "description": "An issue was unpinned from a repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository"
- },
- {
- "action": "issues.deletes_disabled",
- "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "issues.deletes_enabled",
- "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "issues.deletes_policy_cleared",
- "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "members_can_create_pages.disable",
- "description": "The ability for members to publish GitHub Pages sites was disabled.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_pages.enable",
- "description": "The ability for members to publish GitHub Pages sites was enabled.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_private_pages.disable",
- "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_private_pages.enable",
- "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_public_pages.disable",
- "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_public_pages.enable",
- "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_delete_repos.clear",
- "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_delete_repos.disable",
- "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_delete_repos.enable",
- "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_view_dependency_insights.clear",
- "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "members_can_view_dependency_insights.disable",
- "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise"
- },
- {
- "action": "members_can_view_dependency_insights.enable",
- "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.destroy_file",
- "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.download",
- "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "org.accept_business_invitation",
- "description": "An invitation sent to an organization to join an enterprise was accepted.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.add_billing_manager",
- "description": "A billing manager was added to an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_policy_selected_member_disabled",
- "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.advanced_security_policy_selected_member_enabled",
- "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled",
- "description": "Third-party application access for outside collaborators was disabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
- },
- {
- "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
- "description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
- },
- {
- "action": "org.archive",
- "description": "The organization was archived.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.audit_log_export",
- "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
- },
- {
- "action": "org.audit_log_git_event_export",
- "description": "An export of the organization's Git events was created.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
- },
- {
- "action": "org.billing_signup_error",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.block_user",
- "description": "An organization owner blocked a user from accessing the organization's repositories.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
- },
- {
- "action": "org.cancel_business_invitation",
- "description": "An invitation for an organization to join an enterprise was revoked",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.cancel_invitation",
- "description": "An invitation sent to a user to join an organization was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.clear_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codespaces_access_updated",
- "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
- },
- {
- "action": "org.codespaces_ownership_updated",
- "description": "Ownership and payment for codespaces was updated for an organization.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
- },
- {
- "action": "org.codespaces_team_access_allowed",
- "description": "A team has been allowed to use Codespaces for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codespaces_team_access_revoked",
- "description": "A team has been prevented from using Codespaces for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codespaces_trusted_repo_access_granted",
- "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "org.codespaces_trusted_repo_access_revoked",
- "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "org.codespaces_user_access_allowed",
- "description": "A user has been allowed to use Codespaces for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codespaces_user_access_revoked",
- "description": "A user has been prevented from using Codespaces for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.confirm_business_invitation",
- "description": "An invitation for an organization to join an enterprise was confirmed.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.connect_usage_metrics_export",
- "description": "Server statistics were exported for the organization.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics"
- },
- {
- "action": "org.create",
- "description": "An organization was created.",
- "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
- },
- {
- "action": "org.create_actions_secret",
- "description": "A GitHub Actions secret was created for an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.create_actions_variable",
- "description": "A GitHub Actions variable was created for an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org_credential_authorization.deauthorize",
- "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
- "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on"
- },
- {
- "action": "org_credential_authorization.grant",
- "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
- "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on"
- },
- {
- "action": "org_credential_authorization.revoke",
- "description": "An owner revoked authorized credentials.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization"
- },
- {
- "action": "org.disable_member_team_creation_permission",
- "description": "Team creation was limited to owners.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.disable_oauth_app_restrictions",
- "description": "Third-party application access restrictions for an organization were disabled.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
- },
- {
- "action": "org.disable_reader_discussion_creation_permission",
- "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.disable_saml",
- "description": "SAML single sign-on was disabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the organization was disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
- },
- {
- "action": "org.disable_two_factor_requirement",
- "description": "A two-factor authentication requirement was disabled for the organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_disabled",
- "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_enabled",
- "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.enable_member_team_creation_permission",
- "description": "Team creation by members was allowed.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.enable_oauth_app_restrictions",
- "description": "Third-party application access restrictions for an organization were enabled.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
- },
- {
- "action": "org.enable_reader_discussion_creation_permission",
- "description": "An organization owner allowed users with read access to create discussions in an organization",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.enable_saml",
- "description": "SAML single sign-on was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization"
- },
- {
- "action": "org.enable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the organization was enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
- },
- {
- "action": "org.enable_two_factor_requirement",
- "description": "Two-factor authentication is now required for the organization.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.integration_manager_added",
- "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.integration_manager_removed",
- "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.invite_member",
- "description": "A new user was invited to join an organization.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
- },
- {
- "action": "org.invite_to_business",
- "description": "An organization was invited to join an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.oauth_app_access_approved",
- "description": "Access to an organization was granted for an OAuth App.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
- },
- {
- "action": "org.oauth_app_access_blocked",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.oauth_app_access_denied",
- "description": "Access was disabled for an OAuth App that was previously approved.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
- },
- {
- "action": "org.oauth_app_access_requested",
- "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.oauth_app_access_unblocked",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.rate_limited_invites",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.recovery_code_failed",
- "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable"
- },
- {
- "action": "org.recovery_code_used",
- "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable"
- },
- {
- "action": "org.recovery_codes_downloaded",
- "description": "An organization owner downloaded the organization's SSO recovery codes.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes"
- },
- {
- "action": "org.recovery_codes_generated",
- "description": "An organization owner generated the organization's SSO recovery codes.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes"
- },
- {
- "action": "org.recovery_codes_printed",
- "description": "An organization owner printed the organization's SSO recovery codes.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes"
- },
- {
- "action": "org.recovery_codes_viewed",
- "description": "An organization owner viewed the organization's SSO recovery codes.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes"
- },
- {
- "action": "org.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization"
- },
- {
- "action": "org.remove_actions_secret",
- "description": "A GitHub Actions secret was removed from an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.remove_actions_variable",
- "description": "A GitHub Actions variable was removed from an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.remove_billing_manager",
- "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was removed from an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_outside_collaborator",
- "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization"
- },
- {
- "action": "org.rename",
- "description": "An organization was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.required_workflow_create",
- "description": "Triggered when a required workflow is created.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.required_workflow_delete",
- "description": "Triggered when a required workflow is deleted.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.required_workflow_update",
- "description": "Triggered when a required workflow is updated.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.restore_member",
- "description": "An organization member was restored.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
- },
- {
- "action": "org.revoke_external_identity",
- "description": "A member's linked identity was revoked.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity"
- },
- {
- "action": "org.revoke_sso_session",
- "description": "A member's SAML session was revoked.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity"
- },
- {
- "action": "org.runner_group_created",
- "description": "A self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org.runner_group_removed",
- "description": "A self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_renamed",
- "description": "A self-hosted runner group was renamed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_runner_removed",
- "description": "The REST API was used to remove a self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_runners_added",
- "description": "A self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "org.runner_group_runners_updated",
- "description": "A runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_updated",
- "description": "The configuration of a self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_visiblity_updated",
- "description": "The visibility of a self-hosted runner group was updated via the REST API.",
- "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the organization level",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
- },
- {
- "action": "org_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the organization level",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "org_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "org_secret_scanning_generic_secrets.disabled",
- "description": "Generic secrets have been disabled at the organization level",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org_secret_scanning_generic_secrets.enabled",
- "description": "Generic secrets have been enabled at the organization level",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_disabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_enabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_updated",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_disable",
- "description": "Push protection for secret scanning was disabled.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "org.secret_scanning_push_protection_enable",
- "description": "Push protection for secret scanning was enabled.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_disable",
- "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_enable",
- "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.transfer",
- "description": "An organization was transferred between enterprise accounts.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts"
- },
- {
- "action": "org.transfer_outgoing",
- "description": "An organization was transferred between enterprise accounts.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts"
- },
- {
- "action": "org.unarchive",
- "description": "The organization was unarchived.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.unblock_user",
- "description": "A user was unblocked from an organization.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
- },
- {
- "action": "org.update_actions_secret",
- "description": "A GitHub Actions secret was updated for an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.update_actions_settings",
- "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
- },
- {
- "action": "org.update_actions_variable",
- "description": "A GitHub Actions variable was updated for an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.update_default_repository_permission",
- "description": "The default repository permission level for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "org.update_new_repository_default_branch_setting",
- "description": "The name of the default branch was changed for new repositories in the organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
- },
- {
- "action": "org.update_repo_self_hosted_runners_policy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_saml_provider_settings",
- "description": "An organization's SAML provider settings were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_terms_of_service",
- "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
- "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
- },
- {
- "action": "organization_default_label.create",
- "description": "A default label was created for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
- },
- {
- "action": "organization_default_label.destroy",
- "description": "A default label was deleted for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
- },
- {
- "action": "organization_default_label.update",
- "description": "A default label was edited for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
- },
- {
- "action": "organization_domain.approve",
- "description": "A domain was approved for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.create",
- "description": "A domain was added to an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.destroy",
- "description": "A domain was removed from an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain"
- },
- {
- "action": "organization_domain.verify",
- "description": "A domain was verified for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_moderators.add_team",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.add_user",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.remove_team",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.remove_user",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_projects_change.clear",
- "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "organization_projects_change.disable",
- "description": "Organization projects were disabled for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "organization_projects_change.enable",
- "description": "Organization projects were enabled for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "organization_role.assign",
- "description": "An organization role was assigned to a user or team.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles"
- },
- {
- "action": "organization_role.create",
- "description": "A custom organization role was created in an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles"
- },
- {
- "action": "organization_role.destroy",
- "description": "A custom organization role was deleted in an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles"
- },
- {
- "action": "organization_role.revoke",
- "description": "A user or team was unassigned an organization role.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles"
- },
- {
- "action": "organization_role.update",
- "description": "A custom organization role was edited in an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles"
- },
- {
- "action": "packages.package_deleted",
- "description": "An entire package was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_published",
- "description": "A package was published or republished to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "packages.package_version_deleted",
- "description": "A specific package version was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_version_published",
- "description": "A specific package version was published or republished to a package.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "prebuild_configuration.create",
- "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.destroy",
- "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.run_triggered",
- "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.update",
- "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.clear",
- "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.disable",
- "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.enable",
- "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.authorized_users_teams",
- "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
- },
- {
- "action": "protected_branch.branch_allowances",
- "description": "A protected branch allowance was given to a specific user, team or integration.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.create",
- "description": "Branch protection was enabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.destroy",
- "description": "Branch protection was disabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismiss_stale_reviews",
- "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismissal_restricted_users_teams",
- "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.policy_override",
- "description": "A branch protection requirement was overridden by a repository administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.rejected_ref_update",
- "description": "A branch update attempt was rejected.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_admin_enforced",
- "description": "Branch protection was enforced for repository administrators.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_deletions_enforcement_level",
- "description": "Branch deletion was enabled or disabled for a protected branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_force_pushes_enforcement_level",
- "description": "Force pushes were enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_ignore_approvals_from_contributors",
- "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "protected_branch.update_linear_history_requirement_enforcement_level",
- "description": "Required linear commit history was enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_lock_allows_fetch_and_merge",
- "description": "Fork syncing was enabled or disabled for a read-only branch",
- "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_lock_branch_enforcement_level",
- "description": "The enforcement of a branch lock was updated.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "protected_branch.update_name",
- "description": "A branch name pattern was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_pull_request_reviews_enforcement_level",
- "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_code_owner_review",
- "description": "Enforcement of required code owner review was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_last_push_approval",
- "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
- },
- {
- "action": "protected_branch.update_required_approving_review_count",
- "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_required_status_checks_enforcement_level",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_signature_requirement_enforcement_level",
- "description": "Enforcement of required commit signing was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_strict_required_status_checks_policy",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "pull_request.close",
- "description": "A pull request was closed without being merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
- },
- {
- "action": "pull_request.converted_to_draft",
- "description": "A pull request was converted to a draft.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
- },
- {
- "action": "pull_request.create",
- "description": "A pull request was created.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request"
- },
- {
- "action": "pull_request.create_review_request",
- "description": "A review was requested on a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.in_progress",
- "description": "A pull request was marked as in progress.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.indirect_merge",
- "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.merge",
- "description": "A pull request was merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
- },
- {
- "action": "pull_request.ready_for_review",
- "description": "A pull request was marked as ready for review.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
- },
- {
- "action": "pull_request.rebase",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.remove_review_request",
- "description": "A review request was removed from a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.reopen",
- "description": "A pull request was reopened after previously being closed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.create",
- "description": "A review comment was added to a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request_review_comment.delete",
- "description": "A review comment on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.update",
- "description": "A review comment on a pull request was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.delete",
- "description": "A review on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.dismiss",
- "description": "A review on a pull request was dismissed.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
- },
- {
- "action": "pull_request_review.submit",
- "description": "A review on a pull request was submitted.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codespaces_trusted_repo_access_granted",
- "description": "GitHub Codespaces was granted trusted repository access to this repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.codespaces_trusted_repo_access_revoked",
- "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.download_zip",
- "description": "A source code archive of a repository was downloaded as a ZIP file.",
- "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_soft_delete",
- "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_soft_delete_restore",
- "description": "A GitHub Pages site that was previously soft-deleted was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.rename_branch",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.close",
- "description": "Someone closed a security advisory.",
- "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
- },
- {
- "action": "repository_advisory.cve_request",
- "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.github_broadcast",
- "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.github_withdraw",
- "description": "GitHub withdrew a security advisory that was published in error.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.open",
- "description": "Someone opened a draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.publish",
- "description": "Someone published a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.reopen",
- "description": "Someone reopened as draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.update",
- "description": "Someone edited a draft or published security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_branch_protection_evaluation.disable",
- "description": "Branch protections were disabled for the repository.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "repository_branch_protection_evaluation.enable",
- "description": "Branch protections were enabled for this repository.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "repository_content_analysis.disable",
- "description": "Data use settings were disabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_content_analysis.enable",
- "description": "Data use settings were enabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_dependency_graph.disable",
- "description": "The dependency graph was disabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_dependency_graph.enable",
- "description": "The dependency graph was enabled for a private repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_projects_change.clear",
- "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise"
- },
- {
- "action": "repository_projects_change.disable",
- "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_projects_change.enable",
- "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_ruleset.create",
- "description": "A repository ruleset was created.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
- },
- {
- "action": "repository_ruleset.destroy",
- "description": "A repository ruleset was deleted.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
- },
- {
- "action": "repository_ruleset.update",
- "description": "A repository ruleset was edited.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
- },
- {
- "action": "repository_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the repository level",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
- },
- {
- "action": "repository_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the repository level",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning.disable",
- "description": "Secret scanning was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "repository_secret_scanning.enable",
- "description": "Secret scanning was enabled for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_generic_secrets.disabled",
- "description": "Generic secrets have been disabled at the repository level",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_generic_secrets.enabled",
- "description": "Generic secrets have been enabled at the repository level",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_push_protection.disable",
- "description": "Secret scanning push protection was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_secret_scanning_push_protection.enable",
- "description": "Secret scanning push protection was enabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_visibility_change.clear",
- "description": "The repository visibility change setting was cleared for an organization or enterprise.",
- "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility"
- },
- {
- "action": "repository_visibility_change.disable",
- "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_visibility_change.enable",
- "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.auto_dismiss",
- "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts"
- },
- {
- "action": "repository_vulnerability_alert.auto_reopen",
- "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts"
- },
- {
- "action": "repository_vulnerability_alert.create",
- "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
- },
- {
- "action": "repository_vulnerability_alert.dismiss",
- "description": "A Dependabot alert was manually dismissed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.reintroduce",
- "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.reopen",
- "description": "A Dependabot alert was manually reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.resolve",
- "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.authorized_users_teams",
- "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
- },
- {
- "action": "repository_vulnerability_alerts_auto_dismissal.disable",
- "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts_auto_dismissal.enable",
- "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.disable",
- "description": "Dependabot alerts was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.enable",
- "description": "Dependabot alerts was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "required_status_check.create",
- "description": "A status check was marked as required for a protected branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
- },
- {
- "action": "required_status_check.destroy",
- "description": "A status check was no longer marked as required for a protected branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
- },
- {
- "action": "restrict_notification_delivery.disable",
- "description": "Email notification restrictions for an organization or enterprise were disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "restrict_notification_delivery.enable",
- "description": "Email notification restrictions for an organization or enterprise were enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "role.create",
- "description": "A new custom repository role was created.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "role.destroy",
- "description": "A custom repository role was deleted.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "role.update",
- "description": "A custom repository role was edited.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "secret_scanning_alert.create",
- "description": "GitHub detected a secret and created a secret scanning alert.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
- },
- {
- "action": "secret_scanning_alert.reopen",
- "description": "A secret scanning alert was reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.resolve",
- "description": "A secret scanning alert was resolved.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.revoke",
- "description": "A secret scanning alert was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning.disable",
- "description": "Secret scanning was disabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning.enable",
- "description": "Secret scanning was enabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.disable",
- "description": "Secret scanning was disabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.enable",
- "description": "Secret scanning was enabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_push_protection.bypass",
- "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.invoiced_agreement_sign",
- "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.sponsors_patreon_user_create",
- "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account"
- },
- {
- "action": "sponsors.sponsors_patreon_user_destroy",
- "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ssh_certificate_authority.create",
- "description": "An SSH certificate authority for an organization or enterprise was created.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_authority.destroy",
- "description": "An SSH certificate authority for an organization or enterprise was deleted.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.disable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.enable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.set_domain_token_expiration",
- "description": "The verification code expiry time for an organization or enterprise domain was set.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.unverify_domain",
- "description": "An organization or enterprise domain was unverified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.verify_domain",
- "description": "An organization or enterprise domain was verified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.add_member",
- "description": "A member of an organization was added to a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
- },
- {
- "action": "team.add_repository",
- "description": "A team was given access and permissions to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.change_parent_team",
- "description": "A child team was created or a child team's parent was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
- },
- {
- "action": "team.change_privacy",
- "description": "A team's privacy level was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility"
- },
- {
- "action": "team.create",
- "description": "A new team is created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.demote_maintainer",
- "description": "A user was demoted from a team maintainer to a team member.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
- },
- {
- "action": "team.destroy",
- "description": "A team was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization"
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.promote_maintainer",
- "description": "A user was promoted from a team member to a team maintainer.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
- },
- {
- "action": "team.remove_member",
- "description": "An organization member was removed from a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
- },
- {
- "action": "team.remove_repository",
- "description": "A repository was removed from a team's control.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.rename",
- "description": "A team's name was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_sync_tenant.disabled",
- "description": "Team synchronization with a tenant was disabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.enabled",
- "description": "Team synchronization with a tenant was enabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.update_okta_credentials",
- "description": "The Okta credentials for team synchronization with a tenant were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.update_repository_permission",
- "description": "A team's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.create",
- "description": "A Dependabot rule was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.delete",
- "description": "A Dependabot rule was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.disable",
- "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.enable",
- "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.force_disable",
- "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.force_enable",
- "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.update",
- "description": "A Dependabot rule's conditions, actions, or metadata changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.cancel_workflow_run",
- "description": "A workflow run was cancelled.",
- "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.completed_workflow_run",
- "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history"
- },
- {
- "action": "workflows.created_workflow_run",
- "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.prepared_workflow_job",
- "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.rerun_workflow_run",
- "description": "A workflow run was re-run.",
- "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.12/user.json b/src/audit-logs/data/ghes-3.12/user.json
deleted file mode 100644
index 4ace7cd4c904..000000000000
--- a/src/audit-logs/data/ghes-3.12/user.json
+++ /dev/null
@@ -1,1852 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "account_recovery_token.confirm",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.recover",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.update_bill_cycle_day",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.set_actions_fork_pr_approvals_policy",
- "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories"
- },
- {
- "action": "business.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise"
- },
- {
- "action": "business.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise"
- },
- {
- "action": "business.set_fork_pr_workflows_policy",
- "description": "The policy for fork pull request workflows was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "copilot.cfb_seat_added",
- "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_created",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
- "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business"
- },
- {
- "action": "copilot.cfb_seat_assignment_refreshed",
- "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_reused",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_unassigned",
- "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled_by_staff",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "gist.create",
- "description": "A gist was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gist.destroy",
- "description": "A gist was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gist.visibility_change",
- "description": "The visibility of a gist was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git_signing_ssh_public_key.create",
- "description": "An SSH key was added to a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "git_signing_ssh_public_key.delete",
- "description": "An SSH key was removed from a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.publish",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.retire",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.create",
- "description": "An OAuth access token was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token"
- },
- {
- "action": "oauth_access.destroy",
- "description": "An OAuth access token was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_access.regenerate",
- "description": "An OAuth access token was regenerated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.update",
- "description": "An OAuth access token was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_authorization.create",
- "description": "An authorization for an OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_authorization.destroy",
- "description": "An authorization for an OAuth application was deleted.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "passkey.register",
- "description": "A new passkey was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "passkey.remove",
- "description": "A new passkey was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.create",
- "description": "Triggered when you create a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_regenerated",
- "description": "Triggered when you regenerate a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_revoked",
- "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
- "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users"
- },
- {
- "action": "personal_access_token.destroy",
- "description": "Triggered when you delete a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.update",
- "description": "A fine-grained personal access token was updated.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_soft_delete",
- "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_soft_delete_restore",
- "description": "A GitHub Pages site that was previously soft-deleted was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.temporary_access_granted",
- "description": "Temporary access was enabled for a repository.",
- "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_ruleset.create",
- "description": "A repository ruleset was created.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
- },
- {
- "action": "repository_ruleset.destroy",
- "description": "A repository ruleset was deleted.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
- },
- {
- "action": "repository_ruleset.update",
- "description": "A repository ruleset was edited.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
- },
- {
- "action": "security_key.register",
- "description": "A security key was registered for an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "security_key.remove",
- "description": "A security key was removed from an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.sponsored_developer_update_newsletter_send",
- "description": "Triggered when you send an email update to your sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
- },
- {
- "action": "sponsors.sponsors_patreon_user_create",
- "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account"
- },
- {
- "action": "sponsors.sponsors_patreon_user_destroy",
- "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.waitlist_join",
- "description": "You join the waitlist to join GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.accept",
- "description": "Triggered when you accept a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.cancel",
- "description": "Triggered when you cancel a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.create",
- "description": "Triggered when you create a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.decline",
- "description": "Triggered when you decline a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.revoke",
- "description": "Triggered when you revoke a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "trusted_device.register",
- "description": "A new trusted device was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.remove",
- "description": "A trusted device was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.abort",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.complete",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.ignore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_approve",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_decline",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.start",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.two_factor_destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.add_factor",
- "description": "A secondary authentication factor was added to a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.disabled",
- "description": "Two-factor authentication was disabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account"
- },
- {
- "action": "two_factor_authentication.enabled",
- "description": "Two-factor authentication was enabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.password_reset_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.recovery_codes_regenerated",
- "description": "Two factor recovery codes were regenerated for a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.remove_factor",
- "description": "A secondary authentication factor was removed from a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.sign_in_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.update_fallback",
- "description": "The two-factor authentication fallback for a user account was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.add_email",
- "description": "An email address was added to a user account.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account"
- },
- {
- "action": "user.async_delete",
- "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.audit_log_export",
- "description": "Audit log entries were exported.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.block_user",
- "description": "A user was blocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.change_password",
- "description": "A user changed their password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.codespaces_trusted_repo_access_granted",
- "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.codespaces_trusted_repo_access_revoked",
- "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.create",
- "description": "A new user account was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create_integration_secret",
- "description": "A user secret for Codespaces was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.creation_rate_limit_exceeded",
- "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.delete",
- "description": "A user account was destroyed by an asynchronous job.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.demote",
- "description": "A site administrator was demoted to an ordinary user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.destroy",
- "description": "A user deleted his or her account, triggering user.async_delete.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_failure",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_requested",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_success",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.failed_login",
- "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.forgot_password",
- "description": "A user requested a password reset.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
- },
- {
- "action": "user.grant_github_developer",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.hide_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.login",
- "description": "A user signed in.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.logout",
- "description": "A user signed out.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.new_device_used",
- "description": "A user signed in from a new device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.promote",
- "description": "An ordinary user account was promoted to a site administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.recreate",
- "description": "A user's account was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_email",
- "description": "An email address was removed from a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_integration_secret",
- "description": "A user secret for Codespaces was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.rename",
- "description": "A username was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.reset_password",
- "description": "A user reset their account password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_session.country_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.show_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.sign_in_from_unrecognized_device",
- "description": "A user signed in from an unrecognized device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_device_and_location",
- "description": "A user signed in from an unrecognized device and location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.destroy",
- "description": "Triggered when you clear the status on your profile.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.update",
- "description": "Triggered when you set or change the status on your profile.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status"
- },
- {
- "action": "user.suspend",
- "description": "A user account was suspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.toggle_warn_private_email",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_failure",
- "description": "A 2FA challenge issued for a user account failed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_success",
- "description": "A 2FA challenge issued for a user account succeeded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recover",
- "description": "A user used their 2FA recovery codes.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_downloaded",
- "description": "A user downloaded 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_printed",
- "description": "A user printed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_viewed",
- "description": "A user viewed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_requested",
- "description": "A user was prompted for a two-factor authentication code.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
- },
- {
- "action": "user.unblock_user",
- "description": "A user was unblocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unsuspend",
- "description": "A user account was unsuspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_integration_secret",
- "description": "A user secret for Codespaces was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_new_repository_default_branch_setting",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.13/enterprise.json b/src/audit-logs/data/ghes-3.13/enterprise.json
deleted file mode 100644
index fc2c81cb967e..000000000000
--- a/src/audit-logs/data/ghes-3.13/enterprise.json
+++ /dev/null
@@ -1,3437 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "account_recovery_token.confirm",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.recover",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "api.request",
- "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.check",
- "description": "A manual check of the endpoint configured for audit log streaming was performed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.create",
- "description": "An endpoint was added for audit log streaming.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.destroy",
- "description": "An audit log streaming endpoint was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "audit_log_streaming.update",
- "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.update_bill_cycle_day",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.add_admin",
- "description": "An enterprise owner was added to an enterprise.",
- "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise"
- },
- {
- "action": "business.add_organization",
- "description": "An organization was added to an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_advanced_security.disabled",
- "description": "GitHub Advanced Security was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.disabled_for_new_user_namespace_repos",
- "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.enabled",
- "description": "GitHub Advanced Security was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.enabled_for_new_user_namespace_repos",
- "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business.advanced_security_policy_update",
- "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise"
- },
- {
- "action": "business.advanced_security_repo_admin_enablement_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_advanced_security.user_namespace_repos_disabled",
- "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.user_namespace_repos_enabled",
- "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business.clear_actions_settings",
- "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise"
- },
- {
- "action": "business.clear_default_repository_permission",
- "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions"
- },
- {
- "action": "business.clear_members_can_create_repos",
- "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation"
- },
- {
- "action": "business.create",
- "description": "An enterprise was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.dependabot_alerts_repo_admin_enablement_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.disable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise"
- },
- {
- "action": "business.disable_two_factor_requirement",
- "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.enable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise"
- },
- {
- "action": "business.enable_two_factor_requirement",
- "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.clear",
- "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.remove_admin",
- "description": "An enterprise owner was removed from an enterprise.",
- "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise"
- },
- {
- "action": "business.remove_organization",
- "description": "An organization was removed from an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.rename_slug",
- "description": "The slug for the enterprise URL was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the business level",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features"
- },
- {
- "action": "business_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the business level",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features"
- },
- {
- "action": "business_secret_scanning_custom_pattern.create",
- "description": "An enterprise-level custom pattern was created for secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern.delete",
- "description": "An enterprise-level custom pattern was removed from secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_custom_pattern.publish",
- "description": "An enterprise-level custom pattern was published for secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern.update",
- "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning.disable",
- "description": "Secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.disabled_for_new_repos",
- "description": "Secret scanning was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.enable",
- "description": "Secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.enabled_for_new_repos",
- "description": "Secret scanning was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.disable",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.enable",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.update",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.disable",
- "description": "Push protection for secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.disabled_for_new_repos",
- "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.enable",
- "description": "Push protection for secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.enabled_for_new_repos",
- "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business.secret_scanning_repo_admin_settings_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.set_actions_fork_pr_approvals_policy",
- "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories"
- },
- {
- "action": "business.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise"
- },
- {
- "action": "business.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise"
- },
- {
- "action": "business.set_fork_pr_workflows_policy",
- "description": "The policy for fork pull request workflows was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "business.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.update_actions_settings",
- "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise"
- },
- {
- "action": "business.update_default_repository_permission",
- "description": "The base repository permission setting was updated for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions"
- },
- {
- "action": "business.update_member_repository_creation_permission",
- "description": "The repository creation setting was updated for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation"
- },
- {
- "action": "business.update_member_repository_invitation_permission",
- "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.start_environment",
- "description": "A codespace was started.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "copilot.cfb_seat_added",
- "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_created",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
- "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business"
- },
- {
- "action": "copilot.cfb_seat_assignment_refreshed",
- "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_reused",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_unassigned",
- "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled_by_staff",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_property_definition.create",
- "description": "A new custom property definition was created.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_definition.destroy",
- "description": "A custom property definition was deleted.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_definition.update",
- "description": "A custom property definition was updated.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_value.create",
- "description": "A repository's custom property value was manually set for the first time.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_value.destroy",
- "description": "A repository's custom property value was deleted.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_value.update",
- "description": "A repository's custom property value was updated.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "enterprise_announcement.create",
- "description": "A global announcement banner was created for the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner"
- },
- {
- "action": "enterprise_announcement.destroy",
- "description": "A global announcement banner was removed from the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise"
- },
- {
- "action": "enterprise_announcement.update",
- "description": "A global announcement banner was updated for the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise"
- },
- {
- "action": "enterprise.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "enterprise_domain.approve",
- "description": "A domain was approved for an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise_domain.create",
- "description": "A domain was added to an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise_domain.destroy",
- "description": "A domain was removed from an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain"
- },
- {
- "action": "enterprise_domain.verify",
- "description": "A domain was verified for an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise.register_self_hosted_runner",
- "description": "A new GitHub Actions self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "enterprise.remove_self_hosted_runner",
- "description": "A GitHub Actions self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "enterprise.runner_group_created",
- "description": "A GitHub Actions self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "enterprise.runner_group_removed",
- "description": "A GitHub Actions self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "enterprise.runner_group_runner_removed",
- "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "enterprise.runner_group_runners_added",
- "description": "A GitHub Actions self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "enterprise.runner_group_runners_updated",
- "description": "A GitHub Actions runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "enterprise.runner_group_updated",
- "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "enterprise.self_hosted_runner_offline",
- "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "enterprise.self_hosted_runner_online",
- "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "enterprise.self_hosted_runner_updated",
- "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "gist.create",
- "description": "A gist was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gist.destroy",
- "description": "A gist was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gist.visibility_change",
- "description": "The visibility of a gist was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.clone",
- "description": "A repository was cloned.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.fetch",
- "description": "Changes were fetched from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.push",
- "description": "Changes were pushed to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git_signing_ssh_public_key.create",
- "description": "An SSH key was added to a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "git_signing_ssh_public_key.delete",
- "description": "An SSH key was removed from a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "integration.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
- },
- {
- "action": "ip_allow_list.disable",
- "description": "An IP allow list was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_for_installed_apps",
- "description": "An IP allow list was disabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_user_level_enforcement",
- "description": "IP allow list user level enforcement was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable",
- "description": "An IP allow list was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_for_installed_apps",
- "description": "An IP allow list was enabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_user_level_enforcement",
- "description": "IP allow list user level enforcement was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.create",
- "description": "An IP address was added to an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.destroy",
- "description": "An IP address was deleted from an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.update",
- "description": "An IP address or its description was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.publish",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.retire",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.create",
- "description": "An OAuth access token was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token"
- },
- {
- "action": "oauth_access.destroy",
- "description": "An OAuth access token was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_access.regenerate",
- "description": "An OAuth access token was regenerated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.update",
- "description": "An OAuth access token was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.suspend",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.unsuspend",
- "description": "An OAuth application was unsuspended for a user or organization account.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_authorization.create",
- "description": "An authorization for an OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_authorization.destroy",
- "description": "An authorization for an OAuth application was deleted.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations"
- },
- {
- "action": "oauth_authorization.update",
- "description": "An authorization for an OAuth application was updated.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "org.accept_business_invitation",
- "description": "An invitation sent to an organization to join an enterprise was accepted.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.add_billing_manager",
- "description": "A billing manager was added to an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_policy_selected_member_disabled",
- "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.advanced_security_policy_selected_member_enabled",
- "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.async_delete",
- "description": "A user initiated a background job to delete an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.billing_signup_error",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.block_user",
- "description": "An organization owner blocked a user from accessing the organization's repositories.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
- },
- {
- "action": "org.cancel_business_invitation",
- "description": "An invitation for an organization to join an enterprise was revoked",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.cancel_invitation",
- "description": "An invitation sent to a user to join an organization was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.clear_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.confirm_business_invitation",
- "description": "An invitation for an organization to join an enterprise was confirmed.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.create",
- "description": "An organization was created.",
- "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
- },
- {
- "action": "org.delete",
- "description": "An organization was deleted by a user or staff.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_member_team_creation_permission",
- "description": "Team creation was limited to owners.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.disable_reader_discussion_creation_permission",
- "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.disable_saml",
- "description": "SAML single sign-on was disabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_two_factor_requirement",
- "description": "A two-factor authentication requirement was disabled for the organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_disabled",
- "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_enabled",
- "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.enable_member_team_creation_permission",
- "description": "Team creation by members was allowed.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.enable_reader_discussion_creation_permission",
- "description": "An organization owner allowed users with read access to create discussions in an organization",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.enable_saml",
- "description": "SAML single sign-on was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization"
- },
- {
- "action": "org.enable_two_factor_requirement",
- "description": "Two-factor authentication is now required for the organization.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.integration_manager_added",
- "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.integration_manager_removed",
- "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.invite_member",
- "description": "A new user was invited to join an organization.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
- },
- {
- "action": "org.invite_to_business",
- "description": "An organization was invited to join an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.rate_limited_invites",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.recreate",
- "description": "An organization was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization"
- },
- {
- "action": "org.remove_billing_manager",
- "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_outside_collaborator",
- "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization"
- },
- {
- "action": "org.rename",
- "description": "An organization was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.restore_member",
- "description": "An organization member was restored.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
- },
- {
- "action": "org.runner_group_created",
- "description": "A self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org.runner_group_removed",
- "description": "A self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_runner_removed",
- "description": "The REST API was used to remove a self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_runners_added",
- "description": "A self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "org.runner_group_runners_updated",
- "description": "A runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_updated",
- "description": "The configuration of a self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the organization level",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
- },
- {
- "action": "org_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the organization level",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "org_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_disabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_enabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_updated",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_disable",
- "description": "Push protection for secret scanning was disabled.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "org.secret_scanning_push_protection_enable",
- "description": "Push protection for secret scanning was enabled.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_disable",
- "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_enable",
- "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.transform",
- "description": "A user account was converted into an organization.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization"
- },
- {
- "action": "org.unblock_user",
- "description": "A user was unblocked from an organization.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
- },
- {
- "action": "org.update_actions_settings",
- "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
- },
- {
- "action": "org.update_default_repository_permission",
- "description": "The default repository permission level for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "org.update_saml_provider_settings",
- "description": "An organization's SAML provider settings were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_terms_of_service",
- "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
- "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
- },
- {
- "action": "organization_domain.approve",
- "description": "A domain was approved for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.create",
- "description": "A domain was added to an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.destroy",
- "description": "A domain was removed from an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain"
- },
- {
- "action": "organization_domain.verify",
- "description": "A domain was verified for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "packages.package_deleted",
- "description": "An entire package was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_published",
- "description": "A package was published or republished to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "packages.package_version_deleted",
- "description": "A specific package version was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_version_published",
- "description": "A specific package version was published or republished to a package.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "passkey.register",
- "description": "A new passkey was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "passkey.remove",
- "description": "A new passkey was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.create",
- "description": "Triggered when you create a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_regenerated",
- "description": "Triggered when you regenerate a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_revoked",
- "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
- "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users"
- },
- {
- "action": "personal_access_token.destroy",
- "description": "Triggered when you delete a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.update",
- "description": "A fine-grained personal access token was updated.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.authorized_users_teams",
- "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
- },
- {
- "action": "protected_branch.branch_allowances",
- "description": "A protected branch allowance was given to a specific user, team or integration.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.create",
- "description": "Branch protection was enabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.destroy",
- "description": "Branch protection was disabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismiss_stale_reviews",
- "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismissal_restricted_users_teams",
- "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.policy_override",
- "description": "A branch protection requirement was overridden by a repository administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.rejected_ref_update",
- "description": "A branch update attempt was rejected.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_admin_enforced",
- "description": "Branch protection was enforced for repository administrators.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_deletions_enforcement_level",
- "description": "Branch deletion was enabled or disabled for a protected branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_force_pushes_enforcement_level",
- "description": "Force pushes were enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_ignore_approvals_from_contributors",
- "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "protected_branch.update_linear_history_requirement_enforcement_level",
- "description": "Required linear commit history was enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_lock_allows_fetch_and_merge",
- "description": "Fork syncing was enabled or disabled for a read-only branch",
- "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_lock_branch_enforcement_level",
- "description": "The enforcement of a branch lock was updated.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "protected_branch.update_name",
- "description": "A branch name pattern was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_pull_request_reviews_enforcement_level",
- "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_code_owner_review",
- "description": "Enforcement of required code owner review was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_last_push_approval",
- "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
- },
- {
- "action": "protected_branch.update_required_approving_review_count",
- "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_required_status_checks_enforcement_level",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_signature_requirement_enforcement_level",
- "description": "Enforcement of required commit signing was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_strict_required_status_checks_policy",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "pull_request.close",
- "description": "A pull request was closed without being merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
- },
- {
- "action": "pull_request.converted_to_draft",
- "description": "A pull request was converted to a draft.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
- },
- {
- "action": "pull_request.create",
- "description": "A pull request was created.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request"
- },
- {
- "action": "pull_request.create_review_request",
- "description": "A review was requested on a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.in_progress",
- "description": "A pull request was marked as in progress.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.indirect_merge",
- "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.merge",
- "description": "A pull request was merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
- },
- {
- "action": "pull_request.ready_for_review",
- "description": "A pull request was marked as ready for review.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
- },
- {
- "action": "pull_request.rebase",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.remove_review_request",
- "description": "A review request was removed from a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.reopen",
- "description": "A pull request was reopened after previously being closed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.create",
- "description": "A review comment was added to a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request_review_comment.delete",
- "description": "A review comment on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.update",
- "description": "A review comment on a pull request was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.delete",
- "description": "A review on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.dismiss",
- "description": "A review on a pull request was dismissed.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
- },
- {
- "action": "pull_request_review.submit",
- "description": "A review on a pull request was submitted.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.code_scanning_third_party_tools_disabled",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_third_party_tools_enabled",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.codeql_advanced_disabled",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.codeql_advanced_enabled",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.disk_archive",
- "description": "A repository was archived on disk.",
- "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories"
- },
- {
- "action": "repo.download_zip",
- "description": "A source code archive of a repository was downloaded as a ZIP file.",
- "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives"
- },
- {
- "action": "repo.hide_from_discovery",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.noindex",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.override_unlock",
- "description": "The repository was unlocked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_build",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_soft_delete",
- "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_soft_delete_restore",
- "description": "A GitHub Pages site that was previously soft-deleted was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.require_login",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.temporary_access_granted",
- "description": "Temporary access was enabled for a repository.",
- "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_branch_protection_evaluation.disable",
- "description": "Branch protections were disabled for the repository.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "repository_branch_protection_evaluation.enable",
- "description": "Branch protections were enabled for this repository.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_ruleset.create",
- "description": "A repository ruleset was created.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
- },
- {
- "action": "repository_ruleset.destroy",
- "description": "A repository ruleset was deleted.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
- },
- {
- "action": "repository_ruleset.update",
- "description": "A repository ruleset was edited.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
- },
- {
- "action": "repository_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the repository level",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
- },
- {
- "action": "repository_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the repository level",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning.disable",
- "description": "Secret scanning was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "repository_secret_scanning.enable",
- "description": "Secret scanning was enabled for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_push_protection.disable",
- "description": "Secret scanning push protection was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_secret_scanning_push_protection.enable",
- "description": "Secret scanning push protection was enabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "restrict_notification_delivery.disable",
- "description": "Email notification restrictions for an organization or enterprise were disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "restrict_notification_delivery.enable",
- "description": "Email notification restrictions for an organization or enterprise were enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "secret_scanning_alert.create",
- "description": "GitHub detected a secret and created a secret scanning alert.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
- },
- {
- "action": "secret_scanning_alert.reopen",
- "description": "A secret scanning alert was reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.resolve",
- "description": "A secret scanning alert was resolved.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.revoke",
- "description": "A secret scanning alert was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.validate",
- "description": "A secret scanning alert was validated.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
- },
- {
- "action": "secret_scanning.disable",
- "description": "Secret scanning was disabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning.enable",
- "description": "Secret scanning was enabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.disable",
- "description": "Secret scanning was disabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.enable",
- "description": "Secret scanning was enabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_push_protection.bypass",
- "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret"
- },
- {
- "action": "security_key.register",
- "description": "A security key was registered for an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "security_key.remove",
- "description": "A security key was removed from an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.sponsored_developer_update_newsletter_send",
- "description": "Triggered when you send an email update to your sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
- },
- {
- "action": "sponsors.sponsors_patreon_user_create",
- "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account"
- },
- {
- "action": "sponsors.sponsors_patreon_user_destroy",
- "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.waitlist_join",
- "description": "You join the waitlist to join GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ssh_certificate_authority.create",
- "description": "An SSH certificate authority for an organization or enterprise was created.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_authority.destroy",
- "description": "An SSH certificate authority for an organization or enterprise was deleted.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.disable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.enable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "staff.set_domain_token_expiration",
- "description": "The verification code expiry time for an organization or enterprise domain was set.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.unverify_domain",
- "description": "An organization or enterprise domain was unverified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.verify_domain",
- "description": "An organization or enterprise domain was verified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.accept",
- "description": "Triggered when you accept a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.cancel",
- "description": "Triggered when you cancel a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.create",
- "description": "Triggered when you create a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.decline",
- "description": "Triggered when you decline a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.revoke",
- "description": "Triggered when you revoke a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "team.add_member",
- "description": "A member of an organization was added to a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
- },
- {
- "action": "team.add_repository",
- "description": "A team was given access and permissions to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.change_parent_team",
- "description": "A child team was created or a child team's parent was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
- },
- {
- "action": "team.change_privacy",
- "description": "A team's privacy level was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility"
- },
- {
- "action": "team.create",
- "description": "A new team is created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.demote_maintainer",
- "description": "A user was demoted from a team maintainer to a team member.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
- },
- {
- "action": "team.destroy",
- "description": "A team was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization"
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.promote_maintainer",
- "description": "A user was promoted from a team member to a team maintainer.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
- },
- {
- "action": "team.remove_member",
- "description": "An organization member was removed from a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
- },
- {
- "action": "team.remove_repository",
- "description": "A repository was removed from a team's control.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.rename",
- "description": "A team's name was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_sync_tenant.disabled",
- "description": "Team synchronization with a tenant was disabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.enabled",
- "description": "Team synchronization with a tenant was enabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team.update_repository_permission",
- "description": "A team's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.register",
- "description": "A new trusted device was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.remove",
- "description": "A trusted device was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.abort",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.complete",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.ignore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_approve",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_decline",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.start",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.two_factor_destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.add_factor",
- "description": "A secondary authentication factor was added to a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.disabled",
- "description": "Two-factor authentication was disabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account"
- },
- {
- "action": "two_factor_authentication.enabled",
- "description": "Two-factor authentication was enabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.password_reset_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.recovery_codes_regenerated",
- "description": "Two factor recovery codes were regenerated for a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.remove_factor",
- "description": "A secondary authentication factor was removed from a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.sign_in_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.update_fallback",
- "description": "The two-factor authentication fallback for a user account was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.add_email",
- "description": "An email address was added to a user account.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account"
- },
- {
- "action": "user.async_delete",
- "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.audit_log_export",
- "description": "Audit log entries were exported.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.block_user",
- "description": "A user was blocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.change_password",
- "description": "A user changed their password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.codespaces_trusted_repo_access_granted",
- "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.codespaces_trusted_repo_access_revoked",
- "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.correct_password_from_unrecognized_device",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.correct_password_from_unrecognized_device_and_location",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.correct_password_from_unrecognized_location",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create",
- "description": "A new user account was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create_integration_secret",
- "description": "A user secret for Codespaces was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.creation_rate_limit_exceeded",
- "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.delete",
- "description": "A user account was destroyed by an asynchronous job.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.demote",
- "description": "A site administrator was demoted to an ordinary user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.destroy",
- "description": "A user deleted his or her account, triggering user.async_delete.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_failure",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_requested",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_success",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.failed_login",
- "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.flag_as_large_scale_contributor",
- "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.forgot_password",
- "description": "A user requested a password reset.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
- },
- {
- "action": "user.grant_github_developer",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.hide_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.login",
- "description": "A user signed in.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.logout",
- "description": "A user signed out.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.minimize_comment",
- "description": "A comment made by a user was minimized.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.new_device_used",
- "description": "A user signed in from a new device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.partial_two_factor_email_followup",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.promote",
- "description": "An ordinary user account was promoted to a site administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.recreate",
- "description": "A user's account was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_email",
- "description": "An email address was removed from a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_integration_secret",
- "description": "A user secret for Codespaces was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_large_scale_contributor_flag",
- "description": "A user account was no longer flagged as a large scale contributor.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.rename",
- "description": "A username was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.report_abuse",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.report_content",
- "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam"
- },
- {
- "action": "user.reset_password",
- "description": "A user reset their account password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_session.country_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.show_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.sign_in_from_unrecognized_device",
- "description": "A user signed in from an unrecognized device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_device_and_location",
- "description": "A user signed in from an unrecognized device and location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_location",
- "description": "A user signed in from an unrecognized location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.destroy",
- "description": "Triggered when you clear the status on your profile.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.update",
- "description": "Triggered when you set or change the status on your profile.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status"
- },
- {
- "action": "user.suspend",
- "description": "A user account was suspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.toggle_warn_private_email",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_failure",
- "description": "A 2FA challenge issued for a user account failed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_success",
- "description": "A 2FA challenge issued for a user account succeeded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recover",
- "description": "A user used their 2FA recovery codes.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_downloaded",
- "description": "A user downloaded 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_printed",
- "description": "A user printed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_viewed",
- "description": "A user viewed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_requested",
- "description": "A user was prompted for a two-factor authentication code.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
- },
- {
- "action": "user.unblock_user",
- "description": "A user was unblocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unminimize_comment",
- "description": "A comment made by a user was unminimized.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unsuspend",
- "description": "A user account was unsuspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_integration_secret",
- "description": "A user secret for Codespaces was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_new_repository_default_branch_setting",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.cancel_workflow_run",
- "description": "A workflow run was cancelled.",
- "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.completed_workflow_run",
- "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history"
- },
- {
- "action": "workflows.created_workflow_run",
- "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.prepared_workflow_job",
- "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.rerun_workflow_run",
- "description": "A workflow run was re-run.",
- "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.13/organization.json b/src/audit-logs/data/ghes-3.13/organization.json
deleted file mode 100644
index 3a6a8b7ee115..000000000000
--- a/src/audit-logs/data/ghes-3.13/organization.json
+++ /dev/null
@@ -1,3232 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.accept",
- "description": "Credit was accepted for a security advisory.",
- "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
- },
- {
- "action": "advisory_credit.create",
- "description": "Someone was added to the credit section of a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.decline",
- "description": "Credit was declined for a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.destroy",
- "description": "Someone was removed from the credit section of a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "auto_approve_personal_access_token_requests.disable",
- "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
- },
- {
- "action": "auto_approve_personal_access_token_requests.enable",
- "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.attempted_to_create_from_prebuild",
- "description": "An attempt to create a codespace from a prebuild was made.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.business_enablement_updated",
- "description": "Enterprise setting for Codespaces ownership was updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_created",
- "description": "Policies were applied to codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_deleted",
- "description": "Policies were removed from codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_updated",
- "description": "Policies were updated for codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.start_environment",
- "description": "A codespace was started.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "commit_comment.destroy",
- "description": "A commit comment was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "commit_comment.update",
- "description": "A commit comment was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.access_revoked",
- "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_org_settings_changed",
- "description": "Copilot feature settings were changed at the organization level.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_added",
- "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_created",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
- "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business"
- },
- {
- "action": "copilot.cfb_seat_assignment_refreshed",
- "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_reused",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_unassigned",
- "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled_by_staff",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_management_changed",
- "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.content_exclusion_changed",
- "description": "The excluded paths for GitHub Copilot were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.knowledge_base_created",
- "description": "A knowledge base was created in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases"
- },
- {
- "action": "copilot.knowledge_base_deleted",
- "description": "A knowledge base was deleted from the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases"
- },
- {
- "action": "copilot.knowledge_base_updated",
- "description": "A knowledge base was updated in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_property_definition.create",
- "description": "A new custom property definition was created.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_definition.destroy",
- "description": "A custom property definition was deleted.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_definition.update",
- "description": "A custom property definition was updated.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_value.create",
- "description": "A repository's custom property value was manually set for the first time.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_value.destroy",
- "description": "A repository's custom property value was deleted.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "custom_property_value.update",
- "description": "A repository's custom property value was updated.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_comment.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_comment.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "enterprise_installation.create",
- "description": "The GitHub App associated with a GitHub Connect connection was created.",
- "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect"
- },
- {
- "action": "enterprise_installation.destroy",
- "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
- "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "git.clone",
- "description": "A repository was cloned.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.fetch",
- "description": "Changes were fetched from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.push",
- "description": "Changes were pushed to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation_request.close",
- "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
- "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
- },
- {
- "action": "integration_installation_request.create",
- "description": "A member requested that an owner install a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "integration.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
- },
- {
- "action": "ip_allow_list.disable",
- "description": "An IP allow list was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_for_installed_apps",
- "description": "An IP allow list was disabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable",
- "description": "An IP allow list was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_for_installed_apps",
- "description": "An IP allow list was enabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.create",
- "description": "An IP address was added to an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.destroy",
- "description": "An IP address was deleted from an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.update",
- "description": "An IP address or its description was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue_comment.destroy",
- "description": "A comment on an issue was deleted from the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue_comment.update",
- "description": "A comment on an issue (other than the initial one) changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue.destroy",
- "description": "An issue was deleted from the repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue"
- },
- {
- "action": "issue.pinned",
- "description": "An issue was pinned to a repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository"
- },
- {
- "action": "issue.transfer",
- "description": "An issue was transferred to another repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository"
- },
- {
- "action": "issue.unpinned",
- "description": "An issue was unpinned from a repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository"
- },
- {
- "action": "issues.deletes_disabled",
- "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "issues.deletes_enabled",
- "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "issues.deletes_policy_cleared",
- "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "members_can_create_pages.disable",
- "description": "The ability for members to publish GitHub Pages sites was disabled.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_pages.enable",
- "description": "The ability for members to publish GitHub Pages sites was enabled.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_private_pages.disable",
- "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_private_pages.enable",
- "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_public_pages.disable",
- "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_public_pages.enable",
- "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_delete_repos.clear",
- "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_delete_repos.disable",
- "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_delete_repos.enable",
- "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_view_dependency_insights.clear",
- "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "members_can_view_dependency_insights.disable",
- "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise"
- },
- {
- "action": "members_can_view_dependency_insights.enable",
- "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.destroy_file",
- "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.download",
- "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "org.accept_business_invitation",
- "description": "An invitation sent to an organization to join an enterprise was accepted.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.add_billing_manager",
- "description": "A billing manager was added to an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_policy_selected_member_disabled",
- "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.advanced_security_policy_selected_member_enabled",
- "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled",
- "description": "Third-party application access for outside collaborators was disabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
- },
- {
- "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
- "description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
- },
- {
- "action": "org.archive",
- "description": "The organization was archived.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.audit_log_export",
- "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
- },
- {
- "action": "org.audit_log_git_event_export",
- "description": "An export of the organization's Git events was created.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
- },
- {
- "action": "org.billing_signup_error",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.block_user",
- "description": "An organization owner blocked a user from accessing the organization's repositories.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
- },
- {
- "action": "org.cancel_business_invitation",
- "description": "An invitation for an organization to join an enterprise was revoked",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.cancel_invitation",
- "description": "An invitation sent to a user to join an organization was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.clear_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codespaces_access_updated",
- "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
- },
- {
- "action": "org.codespaces_ownership_updated",
- "description": "Ownership and payment for codespaces was updated for an organization.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
- },
- {
- "action": "org.codespaces_team_access_allowed",
- "description": "A team has been allowed to use Codespaces for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codespaces_team_access_revoked",
- "description": "A team has been prevented from using Codespaces for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codespaces_trusted_repo_access_granted",
- "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "org.codespaces_trusted_repo_access_revoked",
- "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "org.codespaces_user_access_allowed",
- "description": "A user has been allowed to use Codespaces for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codespaces_user_access_revoked",
- "description": "A user has been prevented from using Codespaces for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.confirm_business_invitation",
- "description": "An invitation for an organization to join an enterprise was confirmed.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.connect_usage_metrics_export",
- "description": "Server statistics were exported for the organization.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics"
- },
- {
- "action": "org.create",
- "description": "An organization was created.",
- "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
- },
- {
- "action": "org.create_actions_secret",
- "description": "A GitHub Actions secret was created for an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.create_actions_variable",
- "description": "A GitHub Actions variable was created for an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org_credential_authorization.deauthorize",
- "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
- "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on"
- },
- {
- "action": "org_credential_authorization.grant",
- "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
- "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on"
- },
- {
- "action": "org_credential_authorization.revoke",
- "description": "An owner revoked authorized credentials.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization"
- },
- {
- "action": "org.disable_member_team_creation_permission",
- "description": "Team creation was limited to owners.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.disable_oauth_app_restrictions",
- "description": "Third-party application access restrictions for an organization were disabled.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
- },
- {
- "action": "org.disable_reader_discussion_creation_permission",
- "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.disable_saml",
- "description": "SAML single sign-on was disabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the organization was disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
- },
- {
- "action": "org.disable_two_factor_requirement",
- "description": "A two-factor authentication requirement was disabled for the organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_disabled",
- "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_enabled",
- "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.enable_member_team_creation_permission",
- "description": "Team creation by members was allowed.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.enable_oauth_app_restrictions",
- "description": "Third-party application access restrictions for an organization were enabled.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
- },
- {
- "action": "org.enable_reader_discussion_creation_permission",
- "description": "An organization owner allowed users with read access to create discussions in an organization",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.enable_saml",
- "description": "SAML single sign-on was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization"
- },
- {
- "action": "org.enable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the organization was enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
- },
- {
- "action": "org.enable_two_factor_requirement",
- "description": "Two-factor authentication is now required for the organization.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.integration_manager_added",
- "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.integration_manager_removed",
- "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.invite_member",
- "description": "A new user was invited to join an organization.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
- },
- {
- "action": "org.invite_to_business",
- "description": "An organization was invited to join an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.oauth_app_access_approved",
- "description": "Access to an organization was granted for an OAuth App.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
- },
- {
- "action": "org.oauth_app_access_blocked",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.oauth_app_access_denied",
- "description": "Access was disabled for an OAuth App that was previously approved.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
- },
- {
- "action": "org.oauth_app_access_requested",
- "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.oauth_app_access_unblocked",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.rate_limited_invites",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.recovery_code_failed",
- "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable"
- },
- {
- "action": "org.recovery_code_used",
- "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable"
- },
- {
- "action": "org.recovery_codes_downloaded",
- "description": "An organization owner downloaded the organization's SSO recovery codes.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes"
- },
- {
- "action": "org.recovery_codes_generated",
- "description": "An organization owner generated the organization's SSO recovery codes.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes"
- },
- {
- "action": "org.recovery_codes_printed",
- "description": "An organization owner printed the organization's SSO recovery codes.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes"
- },
- {
- "action": "org.recovery_codes_viewed",
- "description": "An organization owner viewed the organization's SSO recovery codes.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes"
- },
- {
- "action": "org.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization"
- },
- {
- "action": "org.remove_actions_secret",
- "description": "A GitHub Actions secret was removed from an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.remove_actions_variable",
- "description": "A GitHub Actions variable was removed from an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.remove_billing_manager",
- "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was removed from an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_outside_collaborator",
- "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization"
- },
- {
- "action": "org.rename",
- "description": "An organization was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.required_workflow_create",
- "description": "Triggered when a required workflow is created.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.required_workflow_delete",
- "description": "Triggered when a required workflow is deleted.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.required_workflow_update",
- "description": "Triggered when a required workflow is updated.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.restore_member",
- "description": "An organization member was restored.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
- },
- {
- "action": "org.revoke_external_identity",
- "description": "A member's linked identity was revoked.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity"
- },
- {
- "action": "org.revoke_sso_session",
- "description": "A member's SAML session was revoked.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity"
- },
- {
- "action": "org.runner_group_created",
- "description": "A self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org.runner_group_removed",
- "description": "A self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_renamed",
- "description": "A self-hosted runner group was renamed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_runner_removed",
- "description": "The REST API was used to remove a self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_runners_added",
- "description": "A self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "org.runner_group_runners_updated",
- "description": "A runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_updated",
- "description": "The configuration of a self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_visiblity_updated",
- "description": "The visibility of a self-hosted runner group was updated via the REST API.",
- "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the organization level",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
- },
- {
- "action": "org_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the organization level",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "org_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "org_secret_scanning_generic_secrets.disabled",
- "description": "Generic secrets have been disabled at the organization level",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org_secret_scanning_generic_secrets.enabled",
- "description": "Generic secrets have been enabled at the organization level",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_disabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_enabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_updated",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_disable",
- "description": "Push protection for secret scanning was disabled.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "org.secret_scanning_push_protection_enable",
- "description": "Push protection for secret scanning was enabled.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_disable",
- "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_enable",
- "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.transfer",
- "description": "An organization was transferred between enterprise accounts.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts"
- },
- {
- "action": "org.transfer_outgoing",
- "description": "An organization was transferred between enterprise accounts.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts"
- },
- {
- "action": "org.unarchive",
- "description": "The organization was unarchived.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.unblock_user",
- "description": "A user was unblocked from an organization.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
- },
- {
- "action": "org.update_actions_secret",
- "description": "A GitHub Actions secret was updated for an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.update_actions_settings",
- "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
- },
- {
- "action": "org.update_actions_variable",
- "description": "A GitHub Actions variable was updated for an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.update_default_repository_permission",
- "description": "The default repository permission level for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "org.update_new_repository_default_branch_setting",
- "description": "The name of the default branch was changed for new repositories in the organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
- },
- {
- "action": "org.update_repo_self_hosted_runners_policy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_saml_provider_settings",
- "description": "An organization's SAML provider settings were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_terms_of_service",
- "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
- "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
- },
- {
- "action": "organization_default_label.create",
- "description": "A default label was created for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
- },
- {
- "action": "organization_default_label.destroy",
- "description": "A default label was deleted for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
- },
- {
- "action": "organization_default_label.update",
- "description": "A default label was edited for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
- },
- {
- "action": "organization_domain.approve",
- "description": "A domain was approved for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.create",
- "description": "A domain was added to an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.destroy",
- "description": "A domain was removed from an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain"
- },
- {
- "action": "organization_domain.verify",
- "description": "A domain was verified for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_moderators.add_team",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.add_user",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.remove_team",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.remove_user",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_projects_change.clear",
- "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "organization_projects_change.disable",
- "description": "Organization projects were disabled for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "organization_projects_change.enable",
- "description": "Organization projects were enabled for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "organization_role.assign",
- "description": "An organization role was assigned to a user or team.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles"
- },
- {
- "action": "organization_role.create",
- "description": "A custom organization role was created in an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles"
- },
- {
- "action": "organization_role.destroy",
- "description": "A custom organization role was deleted in an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles"
- },
- {
- "action": "organization_role.revoke",
- "description": "A user or team was unassigned an organization role.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles"
- },
- {
- "action": "organization_role.update",
- "description": "A custom organization role was edited in an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles"
- },
- {
- "action": "packages.package_deleted",
- "description": "An entire package was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_published",
- "description": "A package was published or republished to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "packages.package_version_deleted",
- "description": "A specific package version was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_version_published",
- "description": "A specific package version was published or republished to a package.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "prebuild_configuration.create",
- "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.destroy",
- "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.run_triggered",
- "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.update",
- "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.clear",
- "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.disable",
- "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.enable",
- "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.authorized_users_teams",
- "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
- },
- {
- "action": "protected_branch.branch_allowances",
- "description": "A protected branch allowance was given to a specific user, team or integration.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.create",
- "description": "Branch protection was enabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.destroy",
- "description": "Branch protection was disabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismiss_stale_reviews",
- "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismissal_restricted_users_teams",
- "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.policy_override",
- "description": "A branch protection requirement was overridden by a repository administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.rejected_ref_update",
- "description": "A branch update attempt was rejected.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_admin_enforced",
- "description": "Branch protection was enforced for repository administrators.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_deletions_enforcement_level",
- "description": "Branch deletion was enabled or disabled for a protected branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_force_pushes_enforcement_level",
- "description": "Force pushes were enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_ignore_approvals_from_contributors",
- "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "protected_branch.update_linear_history_requirement_enforcement_level",
- "description": "Required linear commit history was enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_lock_allows_fetch_and_merge",
- "description": "Fork syncing was enabled or disabled for a read-only branch",
- "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_lock_branch_enforcement_level",
- "description": "The enforcement of a branch lock was updated.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "protected_branch.update_name",
- "description": "A branch name pattern was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_pull_request_reviews_enforcement_level",
- "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_code_owner_review",
- "description": "Enforcement of required code owner review was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_last_push_approval",
- "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
- },
- {
- "action": "protected_branch.update_required_approving_review_count",
- "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_required_status_checks_enforcement_level",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_signature_requirement_enforcement_level",
- "description": "Enforcement of required commit signing was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_strict_required_status_checks_policy",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "pull_request.close",
- "description": "A pull request was closed without being merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
- },
- {
- "action": "pull_request.converted_to_draft",
- "description": "A pull request was converted to a draft.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
- },
- {
- "action": "pull_request.create",
- "description": "A pull request was created.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request"
- },
- {
- "action": "pull_request.create_review_request",
- "description": "A review was requested on a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.in_progress",
- "description": "A pull request was marked as in progress.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.indirect_merge",
- "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.merge",
- "description": "A pull request was merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
- },
- {
- "action": "pull_request.ready_for_review",
- "description": "A pull request was marked as ready for review.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
- },
- {
- "action": "pull_request.rebase",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.remove_review_request",
- "description": "A review request was removed from a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.reopen",
- "description": "A pull request was reopened after previously being closed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.create",
- "description": "A review comment was added to a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request_review_comment.delete",
- "description": "A review comment on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.update",
- "description": "A review comment on a pull request was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.delete",
- "description": "A review on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.dismiss",
- "description": "A review on a pull request was dismissed.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
- },
- {
- "action": "pull_request_review.submit",
- "description": "A review on a pull request was submitted.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.code_scanning_third_party_tools_disabled",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_third_party_tools_enabled",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.codeql_advanced_disabled",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.codeql_advanced_enabled",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codespaces_trusted_repo_access_granted",
- "description": "GitHub Codespaces was granted trusted repository access to this repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.codespaces_trusted_repo_access_revoked",
- "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.download_zip",
- "description": "A source code archive of a repository was downloaded as a ZIP file.",
- "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_soft_delete",
- "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_soft_delete_restore",
- "description": "A GitHub Pages site that was previously soft-deleted was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.rename_branch",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.close",
- "description": "Someone closed a security advisory.",
- "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
- },
- {
- "action": "repository_advisory.cve_request",
- "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.github_broadcast",
- "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.github_withdraw",
- "description": "GitHub withdrew a security advisory that was published in error.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.open",
- "description": "Someone opened a draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.publish",
- "description": "Someone published a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.reopen",
- "description": "Someone reopened as draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.update",
- "description": "Someone edited a draft or published security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_branch_protection_evaluation.disable",
- "description": "Branch protections were disabled for the repository.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "repository_branch_protection_evaluation.enable",
- "description": "Branch protections were enabled for this repository.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "repository_content_analysis.disable",
- "description": "Data use settings were disabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_content_analysis.enable",
- "description": "Data use settings were enabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_dependency_graph.disable",
- "description": "The dependency graph was disabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_dependency_graph.enable",
- "description": "The dependency graph was enabled for a private repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_projects_change.clear",
- "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise"
- },
- {
- "action": "repository_projects_change.disable",
- "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_projects_change.enable",
- "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_ruleset.create",
- "description": "A repository ruleset was created.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
- },
- {
- "action": "repository_ruleset.destroy",
- "description": "A repository ruleset was deleted.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
- },
- {
- "action": "repository_ruleset.update",
- "description": "A repository ruleset was edited.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
- },
- {
- "action": "repository_secret_scanning_automatic_validity_checks.disabled",
- "description": "Automatic partner validation checks have been disabled at the repository level",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
- },
- {
- "action": "repository_secret_scanning_automatic_validity_checks.enabled",
- "description": "Automatic partner validation checks have been enabled at the repository level",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.publish",
- "description": "A custom pattern was published for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning.disable",
- "description": "Secret scanning was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "repository_secret_scanning.enable",
- "description": "Secret scanning was enabled for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_generic_secrets.disabled",
- "description": "Generic secrets have been disabled at the repository level",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_generic_secrets.enabled",
- "description": "Generic secrets have been enabled at the repository level",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_push_protection.disable",
- "description": "Secret scanning push protection was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_secret_scanning_push_protection.enable",
- "description": "Secret scanning push protection was enabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_visibility_change.clear",
- "description": "The repository visibility change setting was cleared for an organization or enterprise.",
- "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility"
- },
- {
- "action": "repository_visibility_change.disable",
- "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_visibility_change.enable",
- "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.auto_dismiss",
- "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts"
- },
- {
- "action": "repository_vulnerability_alert.auto_reopen",
- "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts"
- },
- {
- "action": "repository_vulnerability_alert.create",
- "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
- },
- {
- "action": "repository_vulnerability_alert.dismiss",
- "description": "A Dependabot alert was manually dismissed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.reintroduce",
- "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.reopen",
- "description": "A Dependabot alert was manually reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.resolve",
- "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.authorized_users_teams",
- "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
- },
- {
- "action": "repository_vulnerability_alerts_auto_dismissal.disable",
- "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts_auto_dismissal.enable",
- "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.disable",
- "description": "Dependabot alerts was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.enable",
- "description": "Dependabot alerts was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "required_status_check.create",
- "description": "A status check was marked as required for a protected branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
- },
- {
- "action": "required_status_check.destroy",
- "description": "A status check was no longer marked as required for a protected branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
- },
- {
- "action": "restrict_notification_delivery.disable",
- "description": "Email notification restrictions for an organization or enterprise were disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "restrict_notification_delivery.enable",
- "description": "Email notification restrictions for an organization or enterprise were enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "role.create",
- "description": "A new custom repository role was created.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "role.destroy",
- "description": "A custom repository role was deleted.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "role.update",
- "description": "A custom repository role was edited.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "secret_scanning_alert.create",
- "description": "GitHub detected a secret and created a secret scanning alert.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
- },
- {
- "action": "secret_scanning_alert.reopen",
- "description": "A secret scanning alert was reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.resolve",
- "description": "A secret scanning alert was resolved.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.revoke",
- "description": "A secret scanning alert was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.validate",
- "description": "A secret scanning alert was validated.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
- },
- {
- "action": "secret_scanning.disable",
- "description": "Secret scanning was disabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning.enable",
- "description": "Secret scanning was enabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.disable",
- "description": "Secret scanning was disabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.enable",
- "description": "Secret scanning was enabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_push_protection.bypass",
- "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.invoiced_agreement_sign",
- "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.sponsors_patreon_user_create",
- "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account"
- },
- {
- "action": "sponsors.sponsors_patreon_user_destroy",
- "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ssh_certificate_authority.create",
- "description": "An SSH certificate authority for an organization or enterprise was created.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_authority.destroy",
- "description": "An SSH certificate authority for an organization or enterprise was deleted.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.disable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.enable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.set_domain_token_expiration",
- "description": "The verification code expiry time for an organization or enterprise domain was set.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.unverify_domain",
- "description": "An organization or enterprise domain was unverified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.verify_domain",
- "description": "An organization or enterprise domain was verified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.add_member",
- "description": "A member of an organization was added to a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
- },
- {
- "action": "team.add_repository",
- "description": "A team was given access and permissions to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.change_parent_team",
- "description": "A child team was created or a child team's parent was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
- },
- {
- "action": "team.change_privacy",
- "description": "A team's privacy level was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility"
- },
- {
- "action": "team.create",
- "description": "A new team is created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.demote_maintainer",
- "description": "A user was demoted from a team maintainer to a team member.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
- },
- {
- "action": "team.destroy",
- "description": "A team was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization"
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.promote_maintainer",
- "description": "A user was promoted from a team member to a team maintainer.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
- },
- {
- "action": "team.remove_member",
- "description": "An organization member was removed from a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
- },
- {
- "action": "team.remove_repository",
- "description": "A repository was removed from a team's control.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.rename",
- "description": "A team's name was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_sync_tenant.disabled",
- "description": "Team synchronization with a tenant was disabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.enabled",
- "description": "Team synchronization with a tenant was enabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.update_okta_credentials",
- "description": "The Okta credentials for team synchronization with a tenant were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.update_repository_permission",
- "description": "A team's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.create",
- "description": "A Dependabot rule was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.delete",
- "description": "A Dependabot rule was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.disable",
- "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.enable",
- "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.force_disable",
- "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.force_enable",
- "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "vulnerability_alert_rule.update",
- "description": "A Dependabot rule's conditions, actions, or metadata changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.cancel_workflow_run",
- "description": "A workflow run was cancelled.",
- "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.completed_workflow_run",
- "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history"
- },
- {
- "action": "workflows.created_workflow_run",
- "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.prepared_workflow_job",
- "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.rerun_workflow_run",
- "description": "A workflow run was re-run.",
- "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.13/user.json b/src/audit-logs/data/ghes-3.13/user.json
deleted file mode 100644
index 2963c6aa0588..000000000000
--- a/src/audit-logs/data/ghes-3.13/user.json
+++ /dev/null
@@ -1,1867 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "account_recovery_token.confirm",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.recover",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.update_bill_cycle_day",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.set_actions_fork_pr_approvals_policy",
- "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories"
- },
- {
- "action": "business.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise"
- },
- {
- "action": "business.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise"
- },
- {
- "action": "business.set_fork_pr_workflows_policy",
- "description": "The policy for fork pull request workflows was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.start_environment",
- "description": "A codespace was started.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "copilot.cfb_seat_added",
- "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_created",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
- "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business"
- },
- {
- "action": "copilot.cfb_seat_assignment_refreshed",
- "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_reused",
- "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_assignment_unassigned",
- "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "copilot.cfb_seat_cancelled_by_staff",
- "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "gist.create",
- "description": "A gist was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gist.destroy",
- "description": "A gist was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gist.visibility_change",
- "description": "The visibility of a gist was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git_signing_ssh_public_key.create",
- "description": "An SSH key was added to a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "git_signing_ssh_public_key.delete",
- "description": "An SSH key was removed from a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "integration.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.publish",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.retire",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.create",
- "description": "An OAuth access token was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token"
- },
- {
- "action": "oauth_access.destroy",
- "description": "An OAuth access token was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_access.regenerate",
- "description": "An OAuth access token was regenerated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_access.update",
- "description": "An OAuth access token was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_authorization.create",
- "description": "An authorization for an OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_authorization.destroy",
- "description": "An authorization for an OAuth application was deleted.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "passkey.register",
- "description": "A new passkey was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "passkey.remove",
- "description": "A new passkey was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.create",
- "description": "Triggered when you create a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_regenerated",
- "description": "Triggered when you regenerate a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_revoked",
- "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
- "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users"
- },
- {
- "action": "personal_access_token.destroy",
- "description": "Triggered when you delete a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.update",
- "description": "A fine-grained personal access token was updated.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.configure_self_hosted_jit_runner",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_soft_delete",
- "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_soft_delete_restore",
- "description": "A GitHub Pages site that was previously soft-deleted was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.temporary_access_granted",
- "description": "Temporary access was enabled for a repository.",
- "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_ruleset.create",
- "description": "A repository ruleset was created.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
- },
- {
- "action": "repository_ruleset.destroy",
- "description": "A repository ruleset was deleted.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
- },
- {
- "action": "repository_ruleset.update",
- "description": "A repository ruleset was edited.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
- },
- {
- "action": "security_key.register",
- "description": "A security key was registered for an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "security_key.remove",
- "description": "A security key was removed from an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.sponsored_developer_update_newsletter_send",
- "description": "Triggered when you send an email update to your sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
- },
- {
- "action": "sponsors.sponsors_patreon_user_create",
- "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account"
- },
- {
- "action": "sponsors.sponsors_patreon_user_destroy",
- "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.waitlist_join",
- "description": "You join the waitlist to join GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.accept",
- "description": "Triggered when you accept a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.cancel",
- "description": "Triggered when you cancel a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.create",
- "description": "Triggered when you create a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.decline",
- "description": "Triggered when you decline a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.revoke",
- "description": "Triggered when you revoke a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "trusted_device.register",
- "description": "A new trusted device was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.remove",
- "description": "A trusted device was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.abort",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.complete",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.ignore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_approve",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_decline",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.start",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.two_factor_destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.add_factor",
- "description": "A secondary authentication factor was added to a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.disabled",
- "description": "Two-factor authentication was disabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account"
- },
- {
- "action": "two_factor_authentication.enabled",
- "description": "Two-factor authentication was enabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.password_reset_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.recovery_codes_regenerated",
- "description": "Two factor recovery codes were regenerated for a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.remove_factor",
- "description": "A secondary authentication factor was removed from a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.sign_in_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.update_fallback",
- "description": "The two-factor authentication fallback for a user account was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.add_email",
- "description": "An email address was added to a user account.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account"
- },
- {
- "action": "user.async_delete",
- "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.audit_log_export",
- "description": "Audit log entries were exported.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.block_user",
- "description": "A user was blocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.change_password",
- "description": "A user changed their password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.codespaces_trusted_repo_access_granted",
- "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.codespaces_trusted_repo_access_revoked",
- "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.create",
- "description": "A new user account was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create_integration_secret",
- "description": "A user secret for Codespaces was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.creation_rate_limit_exceeded",
- "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.delete",
- "description": "A user account was destroyed by an asynchronous job.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.demote",
- "description": "A site administrator was demoted to an ordinary user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.destroy",
- "description": "A user deleted his or her account, triggering user.async_delete.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_failure",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_requested",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_success",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.failed_login",
- "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.forgot_password",
- "description": "A user requested a password reset.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
- },
- {
- "action": "user.grant_github_developer",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.hide_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.login",
- "description": "A user signed in.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.logout",
- "description": "A user signed out.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.new_device_used",
- "description": "A user signed in from a new device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.promote",
- "description": "An ordinary user account was promoted to a site administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.recreate",
- "description": "A user's account was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_email",
- "description": "An email address was removed from a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_integration_secret",
- "description": "A user secret for Codespaces was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.rename",
- "description": "A username was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.reset_password",
- "description": "A user reset their account password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_session.country_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.show_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.sign_in_from_unrecognized_device",
- "description": "A user signed in from an unrecognized device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_device_and_location",
- "description": "A user signed in from an unrecognized device and location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.destroy",
- "description": "Triggered when you clear the status on your profile.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.update",
- "description": "Triggered when you set or change the status on your profile.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status"
- },
- {
- "action": "user.suspend",
- "description": "A user account was suspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.toggle_warn_private_email",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_failure",
- "description": "A 2FA challenge issued for a user account failed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_success",
- "description": "A 2FA challenge issued for a user account succeeded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recover",
- "description": "A user used their 2FA recovery codes.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_downloaded",
- "description": "A user downloaded 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_printed",
- "description": "A user printed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_viewed",
- "description": "A user viewed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_requested",
- "description": "A user was prompted for a two-factor authentication code.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
- },
- {
- "action": "user.unblock_user",
- "description": "A user was unblocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unsuspend",
- "description": "A user account was unsuspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_integration_secret",
- "description": "A user secret for Codespaces was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_new_repository_default_branch_setting",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.14/enterprise.json b/src/audit-logs/data/ghes-3.14/enterprise.json
index b5a4813ef395..52f857ef967f 100644
--- a/src/audit-logs/data/ghes-3.14/enterprise.json
+++ b/src/audit-logs/data/ghes-3.14/enterprise.json
@@ -1831,23 +1831,6 @@
"programmatic_access_type"
]
},
- {
- "action": "code.search",
- "description": "A code search was run targeting an organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/search-github/github-code-search",
- "fields": [
- "@timestamp",
- "action",
- "actor_id",
- "business_id",
- "query",
- "org_id",
- "user_id",
- "_document_id",
- "search_string"
- ],
- "docs_reference_titles": "/search-github/github-code-search"
- },
{
"action": "codespaces.allow_permissions",
"description": "A codespace using custom permissions from its devcontainer.json file was launched.",
@@ -2689,8 +2672,8 @@
},
{
"action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"request_id",
"team",
@@ -2707,13 +2690,12 @@
"user_agent",
"operation_type",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor_id",
"action",
@@ -2727,13 +2709,12 @@
"created_at",
"request_id",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"action",
"_document_id",
@@ -2750,13 +2731,12 @@
"number",
"team",
"created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"created_at",
"_document_id",
@@ -2774,8 +2754,7 @@
"request_id",
"user_id",
"number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "enterprise_announcement.create",
@@ -6220,7 +6199,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -6243,7 +6222,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.config.disable_collaborators_only",
@@ -10492,7 +10471,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -10520,7 +10499,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -10548,7 +10527,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.collaborators_only",
@@ -12769,7 +12748,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -12872,7 +12851,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning.disable",
@@ -13064,7 +13043,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "security_key.register",
@@ -13946,7 +13925,7 @@
},
{
"action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"business_id",
@@ -13966,8 +13945,8 @@
},
{
"action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"org_id",
"action",
@@ -13982,12 +13961,11 @@
"@timestamp",
"user_agent",
"_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
+ ]
},
{
"action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"actor_id",
diff --git a/src/audit-logs/data/ghes-3.14/organization.json b/src/audit-logs/data/ghes-3.14/organization.json
index b2b374a36f77..33ee317030bb 100644
--- a/src/audit-logs/data/ghes-3.14/organization.json
+++ b/src/audit-logs/data/ghes-3.14/organization.json
@@ -88,7 +88,7 @@
"created_at",
"_document_id"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
+ "docs_reference_titles": "Editing a repository security advisory"
},
{
"action": "advisory_credit.create",
@@ -362,23 +362,6 @@
"programmatic_access_type"
]
},
- {
- "action": "code.search",
- "description": "A code search was run targeting an organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/search-github/github-code-search",
- "fields": [
- "@timestamp",
- "action",
- "actor_id",
- "business_id",
- "query",
- "org_id",
- "user_id",
- "_document_id",
- "search_string"
- ],
- "docs_reference_titles": "/search-github/github-code-search"
- },
{
"action": "codespaces.allow_permissions",
"description": "A codespace using custom permissions from its devcontainer.json file was launched.",
@@ -967,14 +950,13 @@
},
{
"action": "copilot.knowledge_base_created",
- "description": "A knowledge base was created in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -986,19 +968,17 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.knowledge_base_deleted",
- "description": "A knowledge base was deleted from the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1010,19 +990,17 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.knowledge_base_updated",
- "description": "A knowledge base was updated in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1034,8 +1012,7 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.plan_changed",
@@ -1614,8 +1591,8 @@
},
{
"action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"request_id",
"team",
@@ -1632,13 +1609,12 @@
"user_agent",
"operation_type",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor_id",
"action",
@@ -1652,13 +1628,12 @@
"created_at",
"request_id",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"action",
"_document_id",
@@ -1675,13 +1650,12 @@
"number",
"team",
"created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"created_at",
"_document_id",
@@ -1699,8 +1673,7 @@
"request_id",
"user_id",
"number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "enterprise_announcement.create",
@@ -2990,6 +2963,57 @@
"programmatic_access_type"
]
},
+ {
+ "action": "issue_comment.pinned",
+ "description": "A comment on an issue was pinned to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_comment.unpinned",
+ "description": "A comment on an issue was unpinned from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
{
"action": "issue_comment.update",
"description": "A comment on an issue (other than the initial one) changed.",
@@ -3819,7 +3843,9 @@
"selected_service",
"network_settings_ids",
"previous_settings_ids",
- "network_configuration_id"
+ "network_configuration_id",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -3863,7 +3889,9 @@
"actor_is_bot",
"selected_service",
"network_settings_ids",
- "previous_settings_ids"
+ "previous_settings_ids",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -4302,12 +4330,12 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "Limiting OAuth app and GitHub App access requests and installations"
},
{
"action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
"description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
"fields": [
"actor",
"actor_id",
@@ -4321,7 +4349,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests"
},
{
"action": "org.archive",
@@ -4553,7 +4581,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -4576,7 +4604,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codespaces_access_updated",
@@ -10224,7 +10252,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -10252,7 +10280,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -10280,7 +10308,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codespaces_trusted_repo_access_granted",
@@ -11614,7 +11642,7 @@
"org_id",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
+ "docs_reference_titles": "About repository security advisories"
},
{
"action": "repository_advisory.cve_request",
@@ -12860,7 +12888,7 @@
"alert_number",
"programmatic_access_type"
],
- "docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+ "docs_reference_titles": "About Dependabot alerts"
},
{
"action": "repository_vulnerability_alert.dismiss",
@@ -13271,7 +13299,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -13374,7 +13402,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning.disable",
@@ -13566,7 +13594,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "sponsors.agreement_sign",
@@ -14075,7 +14103,7 @@
},
{
"action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
+ "description": "Dependabot encrypted config was read.",
"docs_reference_links": "N/A",
"fields": [
"user_agent",
@@ -14309,7 +14337,7 @@
},
{
"action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"business_id",
@@ -14329,8 +14357,8 @@
},
{
"action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"org_id",
"action",
@@ -14345,12 +14373,11 @@
"@timestamp",
"user_agent",
"_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
+ ]
},
{
"action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"actor_id",
diff --git a/src/audit-logs/data/ghes-3.15/enterprise.json b/src/audit-logs/data/ghes-3.15/enterprise.json
index c676a2320b82..9f24bc326ce9 100644
--- a/src/audit-logs/data/ghes-3.15/enterprise.json
+++ b/src/audit-logs/data/ghes-3.15/enterprise.json
@@ -1831,23 +1831,6 @@
"programmatic_access_type"
]
},
- {
- "action": "code.search",
- "description": "A code search was run targeting an organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/search-github/github-code-search",
- "fields": [
- "@timestamp",
- "action",
- "actor_id",
- "business_id",
- "query",
- "org_id",
- "user_id",
- "_document_id",
- "search_string"
- ],
- "docs_reference_titles": "/search-github/github-code-search"
- },
{
"action": "codespaces.allow_permissions",
"description": "A codespace using custom permissions from its devcontainer.json file was launched.",
@@ -2689,8 +2672,8 @@
},
{
"action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"request_id",
"team",
@@ -2707,13 +2690,12 @@
"user_agent",
"operation_type",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor_id",
"action",
@@ -2727,13 +2709,12 @@
"created_at",
"request_id",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"action",
"_document_id",
@@ -2750,13 +2731,12 @@
"number",
"team",
"created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"created_at",
"_document_id",
@@ -2774,8 +2754,7 @@
"request_id",
"user_id",
"number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "enterprise_announcement.create",
@@ -6220,7 +6199,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -6243,7 +6222,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.config.disable_collaborators_only",
@@ -10691,7 +10670,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -10719,7 +10698,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -10747,7 +10726,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.collaborators_only",
@@ -12968,7 +12947,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -13071,7 +13050,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning.disable",
@@ -13263,7 +13242,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "security_key.register",
@@ -14241,7 +14220,7 @@
},
{
"action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"business_id",
@@ -14261,8 +14240,8 @@
},
{
"action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"org_id",
"action",
@@ -14277,12 +14256,11 @@
"@timestamp",
"user_agent",
"_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
+ ]
},
{
"action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"actor_id",
diff --git a/src/audit-logs/data/ghes-3.15/organization.json b/src/audit-logs/data/ghes-3.15/organization.json
index 56bdb7174040..6c8b68aaf806 100644
--- a/src/audit-logs/data/ghes-3.15/organization.json
+++ b/src/audit-logs/data/ghes-3.15/organization.json
@@ -88,7 +88,7 @@
"created_at",
"_document_id"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
+ "docs_reference_titles": "Editing a repository security advisory"
},
{
"action": "advisory_credit.create",
@@ -950,14 +950,13 @@
},
{
"action": "copilot.knowledge_base_created",
- "description": "A knowledge base was created in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -969,19 +968,17 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.knowledge_base_deleted",
- "description": "A knowledge base was deleted from the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -993,19 +990,17 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.knowledge_base_updated",
- "description": "A knowledge base was updated in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1017,8 +1012,7 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.plan_changed",
@@ -1621,8 +1615,8 @@
},
{
"action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"request_id",
"team",
@@ -1639,13 +1633,12 @@
"user_agent",
"operation_type",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor_id",
"action",
@@ -1659,13 +1652,12 @@
"created_at",
"request_id",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"action",
"_document_id",
@@ -1682,13 +1674,12 @@
"number",
"team",
"created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"created_at",
"_document_id",
@@ -1706,8 +1697,7 @@
"request_id",
"user_id",
"number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "enterprise_announcement.create",
@@ -2997,6 +2987,57 @@
"programmatic_access_type"
]
},
+ {
+ "action": "issue_comment.pinned",
+ "description": "A comment on an issue was pinned to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_comment.unpinned",
+ "description": "A comment on an issue was unpinned from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
{
"action": "issue_comment.update",
"description": "A comment on an issue (other than the initial one) changed.",
@@ -3826,7 +3867,9 @@
"selected_service",
"network_settings_ids",
"previous_settings_ids",
- "network_configuration_id"
+ "network_configuration_id",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -3870,7 +3913,9 @@
"actor_is_bot",
"selected_service",
"network_settings_ids",
- "previous_settings_ids"
+ "previous_settings_ids",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -4309,12 +4354,12 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "Limiting OAuth app and GitHub App access requests and installations"
},
{
"action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
"description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
"fields": [
"actor",
"actor_id",
@@ -4328,7 +4373,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests"
},
{
"action": "org.archive",
@@ -4560,7 +4605,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -4583,7 +4628,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codespaces_access_updated",
@@ -10449,7 +10494,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -10477,7 +10522,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -10505,7 +10550,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codespaces_trusted_repo_access_granted",
@@ -11839,7 +11884,7 @@
"org_id",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
+ "docs_reference_titles": "About repository security advisories"
},
{
"action": "repository_advisory.cve_request",
@@ -13200,7 +13245,7 @@
"alert_number",
"programmatic_access_type"
],
- "docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+ "docs_reference_titles": "About Dependabot alerts"
},
{
"action": "repository_vulnerability_alert.dismiss",
@@ -13611,7 +13656,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -13657,7 +13702,7 @@
"secret_type_provider",
"report_result"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts"
+ "docs_reference_titles": "Resolving alerts from secret scanning"
},
{
"action": "secret_scanning_alert.resolve",
@@ -13736,7 +13781,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning.disable",
@@ -13928,7 +13973,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "security_configuration.create",
@@ -13970,7 +14015,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -14060,7 +14106,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -14121,7 +14168,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -14631,7 +14679,7 @@
},
{
"action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
+ "description": "Dependabot encrypted config was read.",
"docs_reference_links": "N/A",
"fields": [
"user_agent",
@@ -14961,7 +15009,7 @@
},
{
"action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"business_id",
@@ -14981,8 +15029,8 @@
},
{
"action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"org_id",
"action",
@@ -14997,12 +15045,11 @@
"@timestamp",
"user_agent",
"_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
+ ]
},
{
"action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"actor_id",
diff --git a/src/audit-logs/data/ghes-3.16/enterprise.json b/src/audit-logs/data/ghes-3.16/enterprise.json
index aa9ef721b364..3baff923869f 100644
--- a/src/audit-logs/data/ghes-3.16/enterprise.json
+++ b/src/audit-logs/data/ghes-3.16/enterprise.json
@@ -1973,7 +1973,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_fixed",
@@ -1991,7 +1991,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_by_user",
@@ -2010,7 +2010,7 @@
"alert_numbers",
"dismissal_approver_id"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_created",
@@ -2026,7 +2026,7 @@
"org",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reappeared",
@@ -2044,7 +2044,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reopened_by_user",
@@ -2062,24 +2062,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
- },
- {
- "action": "code.search",
- "description": "A code search was run targeting an organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/search-github/github-code-search",
- "fields": [
- "@timestamp",
- "action",
- "actor_id",
- "business_id",
- "query",
- "org_id",
- "user_id",
- "_document_id",
- "search_string"
- ],
- "docs_reference_titles": "/search-github/github-code-search"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "codespaces.allow_permissions",
@@ -2922,8 +2905,8 @@
},
{
"action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"request_id",
"team",
@@ -2940,13 +2923,12 @@
"user_agent",
"operation_type",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor_id",
"action",
@@ -2960,13 +2942,12 @@
"created_at",
"request_id",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"action",
"_document_id",
@@ -2983,13 +2964,12 @@
"number",
"team",
"created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"created_at",
"_document_id",
@@ -3007,8 +2987,7 @@
"request_id",
"user_id",
"number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "enterprise_announcement.create",
@@ -6501,7 +6480,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -6524,7 +6503,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.config.disable_collaborators_only",
@@ -11096,7 +11075,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -11124,7 +11103,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -11152,7 +11131,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.collaborators_only",
@@ -13509,7 +13488,7 @@
"alert_number",
"programmatic_access_type"
],
- "docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+ "docs_reference_titles": "About Dependabot alerts"
},
{
"action": "repository_vulnerability_alert.dismiss",
@@ -13816,7 +13795,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -13919,7 +13898,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning.disable",
@@ -14111,7 +14090,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "security_configuration.create",
@@ -14153,7 +14132,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -14243,7 +14223,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -14304,7 +14285,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15283,7 +15265,7 @@
},
{
"action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"business_id",
@@ -15303,8 +15285,8 @@
},
{
"action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"org_id",
"action",
@@ -15319,12 +15301,11 @@
"@timestamp",
"user_agent",
"_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
+ ]
},
{
"action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"actor_id",
diff --git a/src/audit-logs/data/ghes-3.16/organization.json b/src/audit-logs/data/ghes-3.16/organization.json
index d0ab9b8b9603..efae4d3be3c2 100644
--- a/src/audit-logs/data/ghes-3.16/organization.json
+++ b/src/audit-logs/data/ghes-3.16/organization.json
@@ -88,7 +88,7 @@
"created_at",
"_document_id"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
+ "docs_reference_titles": "Editing a repository security advisory"
},
{
"action": "advisory_credit.create",
@@ -378,7 +378,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_fixed",
@@ -396,7 +396,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_by_user",
@@ -415,7 +415,7 @@
"alert_numbers",
"dismissal_approver_id"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_created",
@@ -431,7 +431,7 @@
"org",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reappeared",
@@ -449,7 +449,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reopened_by_user",
@@ -467,7 +467,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "codespaces.allow_permissions",
@@ -1057,14 +1057,13 @@
},
{
"action": "copilot.knowledge_base_created",
- "description": "A knowledge base was created in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1076,19 +1075,17 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.knowledge_base_deleted",
- "description": "A knowledge base was deleted from the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1100,19 +1097,17 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.knowledge_base_updated",
- "description": "A knowledge base was updated in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1124,8 +1119,7 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.plan_changed",
@@ -1728,8 +1722,8 @@
},
{
"action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"request_id",
"team",
@@ -1746,13 +1740,12 @@
"user_agent",
"operation_type",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor_id",
"action",
@@ -1766,13 +1759,12 @@
"created_at",
"request_id",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"action",
"_document_id",
@@ -1789,13 +1781,12 @@
"number",
"team",
"created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"created_at",
"_document_id",
@@ -1813,8 +1804,7 @@
"request_id",
"user_id",
"number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "enterprise_announcement.create",
@@ -3104,6 +3094,57 @@
"programmatic_access_type"
]
},
+ {
+ "action": "issue_comment.pinned",
+ "description": "A comment on an issue was pinned to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_comment.unpinned",
+ "description": "A comment on an issue was unpinned from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
{
"action": "issue_comment.update",
"description": "A comment on an issue (other than the initial one) changed.",
@@ -3933,7 +3974,9 @@
"selected_service",
"network_settings_ids",
"previous_settings_ids",
- "network_configuration_id"
+ "network_configuration_id",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -3977,7 +4020,9 @@
"actor_is_bot",
"selected_service",
"network_settings_ids",
- "previous_settings_ids"
+ "previous_settings_ids",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -4416,12 +4461,12 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "Limiting OAuth app and GitHub App access requests and installations"
},
{
"action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
"description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
"fields": [
"actor",
"actor_id",
@@ -4435,7 +4480,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests"
},
{
"action": "org.archive",
@@ -4715,7 +4760,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -4738,7 +4783,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codespaces_access_updated",
@@ -10867,7 +10912,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -10895,7 +10940,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -10923,7 +10968,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codespaces_trusted_repo_access_granted",
@@ -12257,7 +12302,7 @@
"org_id",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
+ "docs_reference_titles": "About repository security advisories"
},
{
"action": "repository_advisory.cve_request",
@@ -13618,7 +13663,7 @@
"alert_number",
"programmatic_access_type"
],
- "docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+ "docs_reference_titles": "About Dependabot alerts"
},
{
"action": "repository_vulnerability_alert.dismiss",
@@ -14052,7 +14097,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.public_leak",
@@ -14074,7 +14119,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -14120,7 +14165,7 @@
"secret_type_provider",
"report_result"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts"
+ "docs_reference_titles": "Resolving alerts from secret scanning"
},
{
"action": "secret_scanning_alert.resolve",
@@ -14199,7 +14244,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning.disable",
@@ -14391,7 +14436,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "security_configuration.create",
@@ -14433,7 +14478,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -14523,7 +14569,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -14584,7 +14631,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15094,7 +15142,7 @@
},
{
"action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
+ "description": "Dependabot encrypted config was read.",
"docs_reference_links": "N/A",
"fields": [
"user_agent",
@@ -15424,7 +15472,7 @@
},
{
"action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"business_id",
@@ -15444,8 +15492,8 @@
},
{
"action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"org_id",
"action",
@@ -15460,12 +15508,11 @@
"@timestamp",
"user_agent",
"_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
+ ]
},
{
"action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"actor_id",
diff --git a/src/audit-logs/data/ghes-3.17/enterprise.json b/src/audit-logs/data/ghes-3.17/enterprise.json
index 5e1d9b8c8ae8..dd8c56641d70 100644
--- a/src/audit-logs/data/ghes-3.17/enterprise.json
+++ b/src/audit-logs/data/ghes-3.17/enterprise.json
@@ -1996,7 +1996,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_fixed",
@@ -2014,7 +2014,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_outdated",
@@ -2031,7 +2031,7 @@
"business_id",
"business"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_by_user",
@@ -2050,7 +2050,7 @@
"alert_numbers",
"dismissal_approver_id"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_approved",
@@ -2073,7 +2073,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_denied",
@@ -2096,7 +2096,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_requested",
@@ -2119,7 +2119,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_created",
@@ -2135,7 +2135,7 @@
"org",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reappeared",
@@ -2153,7 +2153,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reopened_by_user",
@@ -2171,24 +2171,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
- },
- {
- "action": "code.search",
- "description": "A code search was run targeting an organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/search-github/github-code-search",
- "fields": [
- "@timestamp",
- "action",
- "actor_id",
- "business_id",
- "query",
- "org_id",
- "user_id",
- "_document_id",
- "search_string"
- ],
- "docs_reference_titles": "/search-github/github-code-search"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "codespaces.allow_permissions",
@@ -3075,8 +3058,8 @@
},
{
"action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"request_id",
"team",
@@ -3093,13 +3076,12 @@
"user_agent",
"operation_type",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor_id",
"action",
@@ -3113,13 +3095,12 @@
"created_at",
"request_id",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"action",
"_document_id",
@@ -3136,13 +3117,12 @@
"number",
"team",
"created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"created_at",
"_document_id",
@@ -3160,8 +3140,7 @@
"request_id",
"user_id",
"number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "enterprise_announcement.create",
@@ -6745,7 +6724,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -6768,7 +6747,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.config.disable_collaborators_only",
@@ -11514,7 +11493,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -11542,7 +11521,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -11570,7 +11549,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.collaborators_only",
@@ -13927,7 +13906,7 @@
"alert_number",
"programmatic_access_type"
],
- "docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+ "docs_reference_titles": "About Dependabot alerts"
},
{
"action": "repository_vulnerability_alert.dismiss",
@@ -14234,7 +14213,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -14337,7 +14316,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning.disable",
@@ -14529,7 +14508,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_scan.completed",
@@ -14600,7 +14579,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -14690,7 +14670,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -14751,7 +14732,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15730,7 +15712,7 @@
},
{
"action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"business_id",
@@ -15750,8 +15732,8 @@
},
{
"action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"org_id",
"action",
@@ -15766,12 +15748,11 @@
"@timestamp",
"user_agent",
"_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
+ ]
},
{
"action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"actor_id",
diff --git a/src/audit-logs/data/ghes-3.17/organization.json b/src/audit-logs/data/ghes-3.17/organization.json
index 6de5a5d4f18b..57fcd02eb76e 100644
--- a/src/audit-logs/data/ghes-3.17/organization.json
+++ b/src/audit-logs/data/ghes-3.17/organization.json
@@ -88,7 +88,7 @@
"created_at",
"_document_id"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
+ "docs_reference_titles": "Editing a repository security advisory"
},
{
"action": "advisory_credit.create",
@@ -378,7 +378,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_fixed",
@@ -396,7 +396,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_outdated",
@@ -413,7 +413,7 @@
"business_id",
"business"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_by_user",
@@ -432,7 +432,7 @@
"alert_numbers",
"dismissal_approver_id"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_approved",
@@ -455,7 +455,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_denied",
@@ -478,7 +478,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_requested",
@@ -501,7 +501,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_created",
@@ -517,7 +517,7 @@
"org",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reappeared",
@@ -535,7 +535,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reopened_by_user",
@@ -553,7 +553,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "codespaces.allow_permissions",
@@ -1179,14 +1179,13 @@
},
{
"action": "copilot.knowledge_base_created",
- "description": "A knowledge base was created in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1198,19 +1197,17 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.knowledge_base_deleted",
- "description": "A knowledge base was deleted from the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1222,19 +1219,17 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.knowledge_base_updated",
- "description": "A knowledge base was updated in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1246,8 +1241,7 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.plan_changed",
@@ -1894,8 +1888,8 @@
},
{
"action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"request_id",
"team",
@@ -1912,13 +1906,12 @@
"user_agent",
"operation_type",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor_id",
"action",
@@ -1932,13 +1925,12 @@
"created_at",
"request_id",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"action",
"_document_id",
@@ -1955,13 +1947,12 @@
"number",
"team",
"created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"created_at",
"_document_id",
@@ -1979,8 +1970,7 @@
"request_id",
"user_id",
"number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "enterprise_announcement.create",
@@ -3270,6 +3260,57 @@
"programmatic_access_type"
]
},
+ {
+ "action": "issue_comment.pinned",
+ "description": "A comment on an issue was pinned to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_comment.unpinned",
+ "description": "A comment on an issue was unpinned from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
{
"action": "issue_comment.update",
"description": "A comment on an issue (other than the initial one) changed.",
@@ -4099,7 +4140,9 @@
"selected_service",
"network_settings_ids",
"previous_settings_ids",
- "network_configuration_id"
+ "network_configuration_id",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -4143,7 +4186,9 @@
"actor_is_bot",
"selected_service",
"network_settings_ids",
- "previous_settings_ids"
+ "previous_settings_ids",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -4606,12 +4651,12 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "Limiting OAuth app and GitHub App access requests and installations"
},
{
"action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
"description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
"fields": [
"actor",
"actor_id",
@@ -4625,7 +4670,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests"
},
{
"action": "org.archive",
@@ -4905,7 +4950,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -4928,7 +4973,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codespaces_access_updated",
@@ -11097,7 +11142,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -11125,7 +11170,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -11153,7 +11198,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codespaces_trusted_repo_access_granted",
@@ -12487,7 +12532,7 @@
"org_id",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
+ "docs_reference_titles": "About repository security advisories"
},
{
"action": "repository_advisory.cve_request",
@@ -13890,7 +13935,7 @@
"alert_number",
"programmatic_access_type"
],
- "docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+ "docs_reference_titles": "About Dependabot alerts"
},
{
"action": "repository_vulnerability_alert.dismiss",
@@ -14324,7 +14369,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.public_leak",
@@ -14346,7 +14391,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -14392,7 +14437,7 @@
"secret_type_provider",
"report_result"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts"
+ "docs_reference_titles": "Resolving alerts from secret scanning"
},
{
"action": "secret_scanning_alert.resolve",
@@ -14471,7 +14516,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_closure_request.approve",
@@ -14777,7 +14822,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_scan.completed",
@@ -14848,7 +14893,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -14938,7 +14984,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -14999,7 +15046,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15509,7 +15557,7 @@
},
{
"action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
+ "description": "Dependabot encrypted config was read.",
"docs_reference_links": "N/A",
"fields": [
"user_agent",
@@ -15839,7 +15887,7 @@
},
{
"action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"business_id",
@@ -15859,8 +15907,8 @@
},
{
"action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"org_id",
"action",
@@ -15875,12 +15923,11 @@
"@timestamp",
"user_agent",
"_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
+ ]
},
{
"action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"actor_id",
diff --git a/src/audit-logs/data/ghes-3.18/enterprise.json b/src/audit-logs/data/ghes-3.18/enterprise.json
index 5aafa7eeb824..d1f961217c48 100644
--- a/src/audit-logs/data/ghes-3.18/enterprise.json
+++ b/src/audit-logs/data/ghes-3.18/enterprise.json
@@ -1996,7 +1996,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_fixed",
@@ -2014,7 +2014,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_outdated",
@@ -2031,7 +2031,7 @@
"business_id",
"business"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_by_user",
@@ -2050,7 +2050,7 @@
"alert_numbers",
"dismissal_approver_id"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_approved",
@@ -2073,7 +2073,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_denied",
@@ -2096,7 +2096,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_requested",
@@ -2119,7 +2119,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_created",
@@ -2135,7 +2135,7 @@
"org",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reappeared",
@@ -2153,7 +2153,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reopened_by_user",
@@ -2171,24 +2171,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
- },
- {
- "action": "code.search",
- "description": "A code search was run targeting an organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/search-github/github-code-search",
- "fields": [
- "@timestamp",
- "action",
- "actor_id",
- "business_id",
- "query",
- "org_id",
- "user_id",
- "_document_id",
- "search_string"
- ],
- "docs_reference_titles": "/search-github/github-code-search"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "codespaces.allow_permissions",
@@ -3124,8 +3107,8 @@
},
{
"action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"request_id",
"team",
@@ -3142,13 +3125,12 @@
"user_agent",
"operation_type",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor_id",
"action",
@@ -3162,13 +3144,12 @@
"created_at",
"request_id",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"action",
"_document_id",
@@ -3185,13 +3166,12 @@
"number",
"team",
"created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"created_at",
"_document_id",
@@ -3209,8 +3189,7 @@
"request_id",
"user_id",
"number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "enterprise_announcement.create",
@@ -6794,7 +6773,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -6817,7 +6796,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.config.disable_collaborators_only",
@@ -11563,7 +11542,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -11591,7 +11570,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -11619,7 +11598,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.collaborators_only",
@@ -14030,7 +14009,7 @@
"alert_number",
"programmatic_access_type"
],
- "docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+ "docs_reference_titles": "About Dependabot alerts"
},
{
"action": "repository_vulnerability_alert.dismiss",
@@ -14337,7 +14316,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -14440,7 +14419,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning.disable",
@@ -14632,7 +14611,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_scan.completed",
@@ -14703,7 +14682,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -14793,7 +14773,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -14854,7 +14835,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15833,7 +15815,7 @@
},
{
"action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"business_id",
@@ -15853,8 +15835,8 @@
},
{
"action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"org_id",
"action",
@@ -15869,12 +15851,11 @@
"@timestamp",
"user_agent",
"_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
+ ]
},
{
"action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"actor_id",
diff --git a/src/audit-logs/data/ghes-3.18/organization.json b/src/audit-logs/data/ghes-3.18/organization.json
index 5d061925b353..3de92e4d061c 100644
--- a/src/audit-logs/data/ghes-3.18/organization.json
+++ b/src/audit-logs/data/ghes-3.18/organization.json
@@ -88,7 +88,7 @@
"created_at",
"_document_id"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
+ "docs_reference_titles": "Editing a repository security advisory"
},
{
"action": "advisory_credit.create",
@@ -378,7 +378,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_fixed",
@@ -396,7 +396,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_outdated",
@@ -413,7 +413,7 @@
"business_id",
"business"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_by_user",
@@ -432,7 +432,7 @@
"alert_numbers",
"dismissal_approver_id"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_approved",
@@ -455,7 +455,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_denied",
@@ -478,7 +478,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_requested",
@@ -501,7 +501,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_created",
@@ -517,7 +517,7 @@
"org",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reappeared",
@@ -535,7 +535,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reopened_by_user",
@@ -553,7 +553,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "codespaces.allow_permissions",
@@ -1179,14 +1179,13 @@
},
{
"action": "copilot.knowledge_base_created",
- "description": "A knowledge base was created in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1198,19 +1197,17 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.knowledge_base_deleted",
- "description": "A knowledge base was deleted from the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1222,19 +1219,17 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.knowledge_base_updated",
- "description": "A knowledge base was updated in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1246,8 +1241,7 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.plan_changed",
@@ -1943,8 +1937,8 @@
},
{
"action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"request_id",
"team",
@@ -1961,13 +1955,12 @@
"user_agent",
"operation_type",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor_id",
"action",
@@ -1981,13 +1974,12 @@
"created_at",
"request_id",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"action",
"_document_id",
@@ -2004,13 +1996,12 @@
"number",
"team",
"created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"created_at",
"_document_id",
@@ -2028,8 +2019,7 @@
"request_id",
"user_id",
"number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "enterprise_announcement.create",
@@ -3319,6 +3309,57 @@
"programmatic_access_type"
]
},
+ {
+ "action": "issue_comment.pinned",
+ "description": "A comment on an issue was pinned to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_comment.unpinned",
+ "description": "A comment on an issue was unpinned from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
{
"action": "issue_comment.update",
"description": "A comment on an issue (other than the initial one) changed.",
@@ -4224,7 +4265,9 @@
"selected_service",
"network_settings_ids",
"previous_settings_ids",
- "network_configuration_id"
+ "network_configuration_id",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -4268,7 +4311,9 @@
"actor_is_bot",
"selected_service",
"network_settings_ids",
- "previous_settings_ids"
+ "previous_settings_ids",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -4754,12 +4799,12 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "Limiting OAuth app and GitHub App access requests and installations"
},
{
"action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
"description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
"fields": [
"actor",
"actor_id",
@@ -4773,7 +4818,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests"
},
{
"action": "org.archive",
@@ -5073,7 +5118,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -5096,7 +5141,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codespaces_access_updated",
@@ -11288,7 +11333,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -11316,7 +11361,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -11344,7 +11389,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codespaces_trusted_repo_access_granted",
@@ -12678,7 +12723,7 @@
"org_id",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
+ "docs_reference_titles": "About repository security advisories"
},
{
"action": "repository_advisory.cve_request",
@@ -14135,7 +14180,7 @@
"alert_number",
"programmatic_access_type"
],
- "docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+ "docs_reference_titles": "About Dependabot alerts"
},
{
"action": "repository_vulnerability_alert.dismiss",
@@ -14569,7 +14614,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.public_leak",
@@ -14591,7 +14636,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -14637,7 +14682,7 @@
"secret_type_provider",
"report_result"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts"
+ "docs_reference_titles": "Resolving alerts from secret scanning"
},
{
"action": "secret_scanning_alert.resolve",
@@ -14716,7 +14761,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_closure_request.approve",
@@ -14994,7 +15039,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_push_protection_request.complete",
@@ -15021,7 +15066,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_push_protection_request.deny",
@@ -15076,7 +15121,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_scan.completed",
@@ -15147,7 +15192,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15237,7 +15283,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15298,7 +15345,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15808,7 +15856,7 @@
},
{
"action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
+ "description": "Dependabot encrypted config was read.",
"docs_reference_links": "N/A",
"fields": [
"user_agent",
@@ -16138,7 +16186,7 @@
},
{
"action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"business_id",
@@ -16158,8 +16206,8 @@
},
{
"action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"org_id",
"action",
@@ -16174,12 +16222,11 @@
"@timestamp",
"user_agent",
"_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
+ ]
},
{
"action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"actor_id",
diff --git a/src/audit-logs/data/ghes-3.19/enterprise.json b/src/audit-logs/data/ghes-3.19/enterprise.json
index 856ebaa16650..a25304cad3e2 100644
--- a/src/audit-logs/data/ghes-3.19/enterprise.json
+++ b/src/audit-logs/data/ghes-3.19/enterprise.json
@@ -301,7 +301,8 @@
"pricing_target_type",
"pricing_target_id",
"budget_limit_type",
- "alert_recipient_user_ids"
+ "alert_recipient_user_ids",
+ "exclude_cost_center_usage"
]
},
{
@@ -2189,7 +2190,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_fixed",
@@ -2207,7 +2208,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_outdated",
@@ -2224,7 +2225,7 @@
"business_id",
"business"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_by_user",
@@ -2243,7 +2244,7 @@
"alert_numbers",
"dismissal_approver_id"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_approved",
@@ -2266,7 +2267,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_denied",
@@ -2289,7 +2290,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_requested",
@@ -2312,7 +2313,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_created",
@@ -2328,7 +2329,7 @@
"org",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reappeared",
@@ -2346,7 +2347,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reopened_by_user",
@@ -2364,24 +2365,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
- },
- {
- "action": "code.search",
- "description": "A code search was run targeting an organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/search-github/github-code-search",
- "fields": [
- "@timestamp",
- "action",
- "actor_id",
- "business_id",
- "query",
- "org_id",
- "user_id",
- "_document_id",
- "search_string"
- ],
- "docs_reference_titles": "/search-github/github-code-search"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "codespaces.allow_permissions",
@@ -3317,8 +3301,8 @@
},
{
"action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"request_id",
"team",
@@ -3335,13 +3319,12 @@
"user_agent",
"operation_type",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor_id",
"action",
@@ -3355,13 +3338,12 @@
"created_at",
"request_id",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"action",
"_document_id",
@@ -3378,13 +3360,12 @@
"number",
"team",
"created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"created_at",
"_document_id",
@@ -3402,8 +3383,7 @@
"request_id",
"user_id",
"number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "enterprise_announcement.create",
@@ -7207,7 +7187,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -7230,7 +7210,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.config.disable_collaborators_only",
@@ -12191,7 +12171,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -12219,7 +12199,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -12247,7 +12227,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.collaborators_only",
@@ -14712,7 +14692,7 @@
"alert_number",
"programmatic_access_type"
],
- "docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+ "docs_reference_titles": "About Dependabot alerts"
},
{
"action": "repository_vulnerability_alert.dismiss",
@@ -15020,7 +15000,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.create",
@@ -15041,7 +15021,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -15142,7 +15122,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.validate",
@@ -15166,7 +15146,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning.disable",
@@ -15358,7 +15338,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_scan.completed",
@@ -15429,7 +15409,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15519,7 +15500,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15580,7 +15562,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -16635,7 +16618,7 @@
},
{
"action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"business_id",
@@ -16655,8 +16638,8 @@
},
{
"action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"org_id",
"action",
@@ -16671,12 +16654,11 @@
"@timestamp",
"user_agent",
"_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
+ ]
},
{
"action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"actor_id",
diff --git a/src/audit-logs/data/ghes-3.19/organization.json b/src/audit-logs/data/ghes-3.19/organization.json
index 9178acd93808..e0d869d05dba 100644
--- a/src/audit-logs/data/ghes-3.19/organization.json
+++ b/src/audit-logs/data/ghes-3.19/organization.json
@@ -88,7 +88,7 @@
"created_at",
"_document_id"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
+ "docs_reference_titles": "Editing a repository security advisory"
},
{
"action": "advisory_credit.create",
@@ -246,7 +246,8 @@
"pricing_target_type",
"pricing_target_id",
"budget_limit_type",
- "alert_recipient_user_ids"
+ "alert_recipient_user_ids",
+ "exclude_cost_center_usage"
]
},
{
@@ -498,7 +499,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_fixed",
@@ -516,7 +517,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_became_outdated",
@@ -533,7 +534,7 @@
"business_id",
"business"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closed_by_user",
@@ -552,7 +553,7 @@
"alert_numbers",
"dismissal_approver_id"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_approved",
@@ -575,7 +576,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_denied",
@@ -598,7 +599,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_closure_requested",
@@ -621,7 +622,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_created",
@@ -637,7 +638,7 @@
"org",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reappeared",
@@ -655,7 +656,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "code_scanning.alert_reopened_by_user",
@@ -673,7 +674,7 @@
"business",
"alert_numbers"
],
- "docs_reference_titles": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"
+ "docs_reference_titles": "About code scanning"
},
{
"action": "codespaces.allow_permissions",
@@ -1299,14 +1300,13 @@
},
{
"action": "copilot.knowledge_base_created",
- "description": "A knowledge base was created in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1318,19 +1318,17 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.knowledge_base_deleted",
- "description": "A knowledge base was deleted from the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1342,19 +1340,17 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.knowledge_base_updated",
- "description": "A knowledge base was updated in the organization.",
- "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor",
"actor_id",
"user_agent",
"request_id",
- "knowledge_base_name",
"org_id",
"org",
"action",
@@ -1366,8 +1362,7 @@
"business_id",
"actor_is_bot",
"request_access_security_header"
- ],
- "docs_reference_titles": "Creating and managing GitHub Copilot knowledge bases"
+ ]
},
{
"action": "copilot.plan_changed",
@@ -2084,8 +2079,8 @@
},
{
"action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"request_id",
"team",
@@ -2102,13 +2097,12 @@
"user_agent",
"operation_type",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"actor_id",
"action",
@@ -2122,13 +2116,12 @@
"created_at",
"request_id",
"_document_id"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
+ ]
},
{
"action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"action",
"_document_id",
@@ -2145,13 +2138,12 @@
"number",
"team",
"created_at"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"created_at",
"_document_id",
@@ -2169,8 +2161,7 @@
"request_id",
"user_id",
"number"
- ],
- "docs_reference_titles": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
+ ]
},
{
"action": "enterprise_announcement.create",
@@ -3460,6 +3451,57 @@
"programmatic_access_type"
]
},
+ {
+ "action": "issue_comment.pinned",
+ "description": "A comment on an issue was pinned to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_comment.unpinned",
+ "description": "A comment on an issue was unpinned from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
{
"action": "issue_comment.update",
"description": "A comment on an issue (other than the initial one) changed.",
@@ -4459,7 +4501,9 @@
"selected_service",
"network_settings_ids",
"previous_settings_ids",
- "network_configuration_id"
+ "network_configuration_id",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -4503,7 +4547,9 @@
"actor_is_bot",
"selected_service",
"network_settings_ids",
- "previous_settings_ids"
+ "previous_settings_ids",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
],
"docs_reference_titles": "About networking for hosted compute products in your enterprise"
},
@@ -4989,12 +5035,12 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "Limiting OAuth app and GitHub App access requests and installations"
},
{
"action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
"description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
"fields": [
"actor",
"actor_id",
@@ -5008,7 +5054,7 @@
"created_at",
"operation_type"
],
- "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests"
},
{
"action": "org.archive",
@@ -5334,7 +5380,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codeql_enabled",
@@ -5357,7 +5403,7 @@
"business",
"business_id"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
},
{
"action": "org.codespaces_access_updated",
@@ -11728,7 +11774,7 @@
"operation_type",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_enabled",
@@ -11756,7 +11802,7 @@
"languages",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codeql_updated",
@@ -11784,7 +11830,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
+ "docs_reference_titles": "Configuring default setup for code scanning"
},
{
"action": "repo.codespaces_trusted_repo_access_granted",
@@ -13222,7 +13268,7 @@
"org_id",
"request_access_security_header"
],
- "docs_reference_titles": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
+ "docs_reference_titles": "About repository security advisories"
},
{
"action": "repository_advisory.cve_request",
@@ -14679,7 +14725,7 @@
"alert_number",
"programmatic_access_type"
],
- "docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+ "docs_reference_titles": "About Dependabot alerts"
},
{
"action": "repository_vulnerability_alert.dismiss",
@@ -15114,7 +15160,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.create",
@@ -15135,7 +15181,30 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning_alert.delete",
+ "description": "A secret scanning alert was deleted by GitHub.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "created_at",
+ "reason"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.public_leak",
@@ -15157,7 +15226,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.reopen",
@@ -15203,7 +15272,7 @@
"secret_type_provider",
"report_result"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts"
+ "docs_reference_titles": "Resolving alerts from secret scanning"
},
{
"action": "secret_scanning_alert.resolve",
@@ -15280,7 +15349,7 @@
"multi_repo",
"created_at"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_alert.validate",
@@ -15304,7 +15373,7 @@
"publicly_leaked",
"multi_repo"
],
- "docs_reference_titles": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+ "docs_reference_titles": "Manage secret scanning alerts"
},
{
"action": "secret_scanning_closure_request.approve",
@@ -15582,7 +15651,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_push_protection_request.complete",
@@ -15609,7 +15678,7 @@
"business_id",
"actor_is_bot"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_push_protection_request.deny",
@@ -15664,7 +15733,7 @@
"actor_is_bot",
"request_access_security_header"
],
- "docs_reference_titles": "Working with secret scanning and push protection"
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
},
{
"action": "secret_scanning_scan.completed",
@@ -15735,7 +15804,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15825,7 +15895,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -15886,7 +15957,8 @@
"security_configuration_secret_scanning_delegated_alert_dismissal",
"security_configuration_code_scanning_delegated_alert_dismissal",
"security_configuration_code_security_sku_enabled",
- "security_configuration_secret_protection_sku_enabled"
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
]
},
{
@@ -16396,7 +16468,7 @@
},
{
"action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
+ "description": "Dependabot encrypted config was read.",
"docs_reference_links": "N/A",
"fields": [
"user_agent",
@@ -16750,7 +16822,7 @@
},
{
"action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"business_id",
@@ -16770,8 +16842,8 @@
},
{
"action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
"fields": [
"org_id",
"action",
@@ -16786,12 +16858,11 @@
"@timestamp",
"user_agent",
"_document_id"
- ],
- "docs_reference_titles": "Organizations and teams documentation"
+ ]
},
{
"action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
+ "description": "N/A",
"docs_reference_links": "N/A",
"fields": [
"actor_id",
diff --git a/src/audit-logs/data/ghes-3.19/user.json b/src/audit-logs/data/ghes-3.19/user.json
index 0c592e710078..f91931785d5f 100644
--- a/src/audit-logs/data/ghes-3.19/user.json
+++ b/src/audit-logs/data/ghes-3.19/user.json
@@ -169,7 +169,8 @@
"pricing_target_type",
"pricing_target_id",
"budget_limit_type",
- "alert_recipient_user_ids"
+ "alert_recipient_user_ids",
+ "exclude_cost_center_usage"
]
},
{
diff --git a/src/audit-logs/data/ghes-3.20/enterprise.json b/src/audit-logs/data/ghes-3.20/enterprise.json
new file mode 100644
index 000000000000..77205f9f3c9f
--- /dev/null
+++ b/src/audit-logs/data/ghes-3.20/enterprise.json
@@ -0,0 +1,19061 @@
+[
+ {
+ "action": "account.billing_date_change",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "@timestamp",
+ "operation_type",
+ "user_agent",
+ "_document_id",
+ "created_at",
+ "action",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org_id"
+ ]
+ },
+ {
+ "action": "account.plan_change",
+ "description": "The account's plan changed.",
+ "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
+ "fields": [
+ "actor",
+ "operation_type",
+ "_document_id",
+ "user_agent",
+ "created_at",
+ "actor_id",
+ "request_id",
+ "@timestamp",
+ "user",
+ "action",
+ "user_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "How GitHub billing works"
+ },
+ {
+ "action": "account_recovery_token.confirm",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "created_at",
+ "_document_id",
+ "token_id",
+ "user_id",
+ "user",
+ "actor",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "account_recovery_token.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "created_at",
+ "token_id",
+ "user",
+ "request_id",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "user_id",
+ "actor_id",
+ "operation_type",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "account_recovery_token.recover",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "@timestamp",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "actor",
+ "user_agent",
+ "request_id",
+ "action",
+ "_document_id",
+ "user_id",
+ "token_id"
+ ]
+ },
+ {
+ "action": "actions_cache.delete",
+ "description": "A GitHub Actions cache was deleted using the REST API.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "user_id",
+ "user",
+ "repo_id",
+ "repo",
+ "org",
+ "org_id",
+ "actions_cache_id",
+ "actions_cache_key",
+ "actions_cache_version",
+ "actions_cache_scope",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "api.request",
+ "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
+ "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_method",
+ "query_string",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "request_body",
+ "status_code",
+ "url_path",
+ "business",
+ "business_id",
+ "org",
+ "org_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "route",
+ "rate_limit_remaining",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Streaming the audit log for your enterprise"
+ },
+ {
+ "action": "artifact.destroy",
+ "description": "A workflow run artifact was manually deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "actor",
+ "user_agent",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "request_id",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "operation_type",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "audit_log_streaming.check",
+ "description": "A manual check of the endpoint configured for audit log streaming was performed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "audit_log_stream_result",
+ "business_id",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "audit_log_stream_sink_details",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "audit_log_streaming.create",
+ "description": "An endpoint was added for audit log streaming.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "business_id",
+ "business",
+ "audit_log_stream_sink",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "audit_log_stream_id"
+ ]
+ },
+ {
+ "action": "audit_log_streaming.destroy",
+ "description": "An audit log streaming endpoint was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "business_id",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "audit_log_stream_id",
+ "audit_log_stream_sink_details"
+ ]
+ },
+ {
+ "action": "audit_log_streaming.update",
+ "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "audit_log_stream_enabled",
+ "business_id",
+ "business",
+ "audit_log_stream_sink",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "new_s3_bucket",
+ "old_s3_bucket",
+ "secrets_updated",
+ "new_s3_arn_role",
+ "old_s3_arn_role",
+ "new_azure_blob_container",
+ "old_azure_blob_container",
+ "new_event_hub_instance",
+ "old_event_hub_instance",
+ "new_splunk_domain",
+ "old_splunk_domain",
+ "ssl_verify",
+ "old_gc_bucket"
+ ]
+ },
+ {
+ "action": "billing.budget_create",
+ "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "customer_id",
+ "target_amount",
+ "target_type",
+ "target_id",
+ "alert_enabled",
+ "status",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "pricing_target_type",
+ "pricing_target_id",
+ "budget_limit_type",
+ "alert_recipient_user_ids",
+ "exclude_cost_center_usage"
+ ]
+ },
+ {
+ "action": "billing.budget_delete",
+ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "customer_id",
+ "uuid",
+ "status",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "billing.budget_update",
+ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "customer_id",
+ "target_amount",
+ "target_type",
+ "target_id",
+ "alert_enabled",
+ "status",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header",
+ "old_target_amount",
+ "old_budget_limit_type",
+ "old_alert_enabled",
+ "old_target_id",
+ "old_pricing_target_type",
+ "old_pricing_target_id"
+ ]
+ },
+ {
+ "action": "billing.change_billing_type",
+ "description": "The way the account pays for GitHub was changed.",
+ "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
+ "fields": [
+ "actor_id",
+ "user",
+ "@timestamp",
+ "actor",
+ "user_id",
+ "action",
+ "created_at",
+ "operation_type",
+ "_document_id",
+ "user_agent",
+ "request_id"
+ ],
+ "docs_reference_titles": "Managing your payment and billing information"
+ },
+ {
+ "action": "billing.change_email",
+ "description": "The billing email address changed.",
+ "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
+ "fields": [
+ "actor",
+ "operation_type",
+ "actor_id",
+ "org_id",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "created_at",
+ "_document_id",
+ "org",
+ "email",
+ "action",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing your payment and billing information"
+ },
+ {
+ "action": "billing_customer.azure_subscription_linked",
+ "description": "Azure subscription has been linked on this account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "billing_customer.azure_subscription_unlinked",
+ "description": "Azure subscription has been unlinked on this account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "billing.lock",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "oauth_application_id",
+ "@timestamp",
+ "actor_id",
+ "operation_type",
+ "_document_id",
+ "request_id",
+ "actor",
+ "user",
+ "user_id",
+ "user_agent",
+ "created_at",
+ "action"
+ ]
+ },
+ {
+ "action": "billing.overage_policy_updated",
+ "description": "The premium request paid usage policy for your GitHub account was changed.",
+ "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage"
+ },
+ {
+ "action": "billing.unlock",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user",
+ "operation_type",
+ "user_agent",
+ "created_at",
+ "user_id",
+ "request_id",
+ "actor",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "billing.update_bill_cycle_day",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "business.add_admin",
+ "description": "An enterprise owner was added to an enterprise.",
+ "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
+ "fields": [
+ "name",
+ "business",
+ "user",
+ "user_id",
+ "@timestamp",
+ "created_at",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "request_id",
+ "business_id",
+ "_document_id",
+ "user_agent",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Inviting people to manage your enterprise"
+ },
+ {
+ "action": "business.add_organization",
+ "description": "An organization was added to an enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "operation_type",
+ "@timestamp",
+ "actor",
+ "business_id",
+ "org",
+ "action",
+ "user_agent",
+ "actor_id",
+ "name",
+ "created_at",
+ "request_id",
+ "_document_id",
+ "business",
+ "organization_upgrade",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business_advanced_security.disabled",
+ "description": "GitHub Advanced Security was disabled for your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_advanced_security.disabled_for_new_repos",
+ "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_advanced_security.disabled_for_new_user_namespace_repos",
+ "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_advanced_security.enabled",
+ "description": "GitHub Advanced Security was enabled for your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_advanced_security.enabled_for_new_repos",
+ "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_advanced_security.enabled_for_new_user_namespace_repos",
+ "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business.advanced_security_policy_update",
+ "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "new_policy",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
+ },
+ {
+ "action": "business.advanced_security_repo_admin_enablement_policy_update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "new_policy",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business_advanced_security.user_namespace_repos_disabled",
+ "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_advanced_security.user_namespace_repos_enabled",
+ "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business.clear_actions_settings",
+ "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.clear_default_repository_permission",
+ "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
+ "fields": [
+ "name",
+ "operation_type",
+ "business_id",
+ "user_agent",
+ "actor_id",
+ "request_id",
+ "actor",
+ "_document_id",
+ "business",
+ "action",
+ "@timestamp",
+ "created_at"
+ ],
+ "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+ },
+ {
+ "action": "business.clear_members_can_create_repos",
+ "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation",
+ "fields": [
+ "user_agent",
+ "actor_id",
+ "business_id",
+ "action",
+ "_document_id",
+ "request_id",
+ "name",
+ "business",
+ "visibility",
+ "created_at",
+ "actor",
+ "operation_type",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+ },
+ {
+ "action": "business.code_scanning_autofix_policy_update",
+ "description": "The policy for Code scanning autofix was updated for an enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "new_policy",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business.code_scanning_autofix_third_party_tools_policy_update",
+ "description": "The policy for Code scanning autofix third party tools was updated for an enterprise.",
+ "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "new_policy",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security"
+ },
+ {
+ "action": "business.code_security_enablement_policy_update",
+ "description": "The policy for Code Security enablement was updated for an enterprise.",
+ "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "name",
+ "new_policy",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security"
+ },
+ {
+ "action": "business.create",
+ "description": "An enterprise was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "_document_id",
+ "action",
+ "@timestamp",
+ "request_id",
+ "name",
+ "business",
+ "business_id",
+ "operation_type",
+ "actor",
+ "created_at",
+ "user_agent",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business_dependabot_alerts_new_repos.disable",
+ "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "business_dependabot_alerts_new_repos.enable",
+ "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "business.dependabot_alerts_repo_admin_enablement_policy_update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "new_policy",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "business.disable_open_scim",
+ "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business.disable_source_ip_disclosure",
+ "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
+ "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Displaying IP addresses in the audit log for your enterprise"
+ },
+ {
+ "action": "business.disable_two_factor_requirement",
+ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "@timestamp",
+ "actor",
+ "business",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "business_id",
+ "actor_id",
+ "name",
+ "_document_id",
+ "request_id"
+ ]
+ },
+ {
+ "action": "business.enable_open_scim",
+ "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "business.enable_source_ip_disclosure",
+ "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
+ "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Displaying IP addresses in the audit log for your enterprise"
+ },
+ {
+ "action": "business.enable_two_factor_requirement",
+ "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "user_agent",
+ "actor",
+ "operation_type",
+ "created_at",
+ "business",
+ "business_id",
+ "name",
+ "_document_id",
+ "request_id",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "business.members_can_update_protected_branches.clear",
+ "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "action",
+ "created_at",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "request_id",
+ "business",
+ "name",
+ "operation_type",
+ "user",
+ "user_agent",
+ "business_id",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "business.members_can_update_protected_branches.disable",
+ "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "business.members_can_update_protected_branches.enable",
+ "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "name",
+ "actor",
+ "operation_type",
+ "_document_id",
+ "business_id",
+ "user",
+ "@timestamp",
+ "business",
+ "actor_id",
+ "created_at",
+ "action",
+ "user_agent",
+ "request_id",
+ "user_id"
+ ]
+ },
+ {
+ "action": "business.remove_admin",
+ "description": "An enterprise owner was removed from an enterprise.",
+ "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
+ "fields": [
+ "actor",
+ "operation_type",
+ "user_agent",
+ "business",
+ "business_id",
+ "@timestamp",
+ "created_at",
+ "request_id",
+ "action",
+ "name",
+ "actor_id",
+ "user_id",
+ "_document_id",
+ "user"
+ ],
+ "docs_reference_titles": "Inviting people to manage your enterprise"
+ },
+ {
+ "action": "business.remove_organization",
+ "description": "An organization was removed from an enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "action",
+ "business",
+ "actor",
+ "actor_id",
+ "request_id",
+ "created_at",
+ "user_agent",
+ "business_id",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "name",
+ "org"
+ ]
+ },
+ {
+ "action": "business.rename_slug",
+ "description": "The slug for the enterprise URL was renamed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "name",
+ "business_id",
+ "user_agent",
+ "action",
+ "actor_id",
+ "operation_type",
+ "actor",
+ "@timestamp",
+ "created_at",
+ "business",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "business.revoke_sso_session",
+ "description": "The SAML single sign-on session for a member in an enterprise was revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "business_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "operation_type",
+ "actor",
+ "_document_id",
+ "actor_id",
+ "name",
+ "@timestamp",
+ "user_id",
+ "action",
+ "created_at",
+ "business"
+ ]
+ },
+ {
+ "action": "business_secret_scanning_automatic_validity_checks.disabled",
+ "description": "Automatic partner validation checks have been disabled at the business level",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning_automatic_validity_checks.enabled",
+ "description": "Automatic partner validation checks have been enabled at the business level",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning_custom_pattern.create",
+ "description": "An enterprise-level custom pattern was created for secret scanning.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "business_secret_scanning_custom_pattern.delete",
+ "description": "An enterprise-level custom pattern was removed from secret scanning.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "business_secret_scanning_custom_pattern.publish",
+ "description": "An enterprise-level custom pattern was published for secret scanning.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business_secret_scanning_custom_pattern_push_protection.disabled",
+ "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "business_secret_scanning_custom_pattern_push_protection.enabled",
+ "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "business_secret_scanning_custom_pattern.update",
+ "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "business_secret_scanning.disable",
+ "description": "Secret scanning was disabled for your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning.disabled_for_new_repos",
+ "description": "Secret scanning was disabled for new repositories in your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning.enable",
+ "description": "Secret scanning was enabled for your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning.enabled_for_new_repos",
+ "description": "Secret scanning was enabled for new repositories in your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning_non_provider_patterns.disabled",
+ "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.",
+ "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Supported secret scanning patterns"
+ },
+ {
+ "action": "business_secret_scanning_non_provider_patterns.enabled",
+ "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.",
+ "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Supported secret scanning patterns"
+ },
+ {
+ "action": "business_secret_scanning_push_protection_custom_message.disable",
+ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning_push_protection_custom_message.enable",
+ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning_push_protection_custom_message.update",
+ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning_push_protection.disable",
+ "description": "Push protection for secret scanning was disabled for your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning_push_protection.disabled_for_new_repos",
+ "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning_push_protection.enable",
+ "description": "Push protection for secret scanning was enabled for your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning_push_protection.enabled_for_new_repos",
+ "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
+ "description": "The push protection setting was updated for a secret type for your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor_id",
+ "actor",
+ "business",
+ "business_id",
+ "push_protection_setting",
+ "secret_type",
+ "secret_type_display_name",
+ "created_at"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business_secret_scanning_push_protection_pattern_configuration.updated",
+ "description": "The push protection pattern configuration was updated for your enterprise.",
+ "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
+ "fields": [
+ "actor_id",
+ "actor",
+ "business",
+ "business_id",
+ "created_at"
+ ],
+ "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+ },
+ {
+ "action": "business.secret_scanning_repo_admin_settings_policy_update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "new_policy",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business.security_center_export_code_scanning_metrics",
+ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "start_date",
+ "end_date",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business.security_center_export_coverage",
+ "description": "A CSV export was requested on the \"Coverage\" page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business.security_center_export_overview_dashboard",
+ "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "start_date",
+ "end_date",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business.security_center_export_risk",
+ "description": "A CSV export was requested on the \"Risk\" page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "business.set_actions_cache_retention_policy",
+ "description": "The cache retention policy for GitHub Actions was set for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "name",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_actions_cache_storage_policy",
+ "description": "The cache storage policy for GitHub Actions was set for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "name",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_actions_fork_pr_approvals_policy",
+ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "policy",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_actions_private_fork_pr_approvals_policy",
+ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "policy",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_actions_retention_limit",
+ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "limit",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_default_workflow_permissions",
+ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_fork_pr_workflows_policy",
+ "description": "The policy for fork pull request workflows was changed for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "policy",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_workflow_permission_can_approve_pr",
+ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.sso_response",
+ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "issuer",
+ "name",
+ "user_agent",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "business",
+ "business_id",
+ "actor_id",
+ "created_at",
+ "request_id",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business.update_actions_settings",
+ "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "updated_github_owned_allowed",
+ "updated_verified_allowed",
+ "updated_patterns",
+ "new_policy",
+ "old_policy",
+ "updated_access_policy"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.update_default_repository_permission",
+ "description": "The base repository permission setting was updated for all organizations in an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
+ "fields": [
+ "business_id",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "permission",
+ "action",
+ "created_at",
+ "@timestamp",
+ "request_id",
+ "name",
+ "_document_id",
+ "old_permission",
+ "business"
+ ],
+ "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+ },
+ {
+ "action": "business.update_member_repository_creation_permission",
+ "description": "The repository creation setting was updated for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation",
+ "fields": [
+ "created_at",
+ "_document_id",
+ "request_id",
+ "name",
+ "business_id",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "operation_type",
+ "permission",
+ "action",
+ "business",
+ "user_agent",
+ "visibility"
+ ],
+ "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+ },
+ {
+ "action": "business.update_member_repository_invitation_permission",
+ "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories",
+ "fields": [
+ "business_id",
+ "created_at",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "request_id",
+ "permission",
+ "actor",
+ "actor_id",
+ "name",
+ "_document_id",
+ "user_agent",
+ "business"
+ ],
+ "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+ },
+ {
+ "action": "checks.auto_trigger_disabled",
+ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
+ "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
+ "fields": [
+ "visibility",
+ "user_agent",
+ "user",
+ "@timestamp",
+ "repo",
+ "actor_id",
+ "user_id",
+ "action",
+ "created_at",
+ "actor",
+ "operation_type",
+ "request_id",
+ "repo_id",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
+ },
+ {
+ "action": "checks.auto_trigger_enabled",
+ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
+ "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo"
+ ],
+ "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
+ },
+ {
+ "action": "checks.delete_logs",
+ "description": "Logs in a check suite were deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "actor",
+ "actor_id",
+ "operation_type",
+ "repo_id",
+ "action",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "code_scanning.alert_appeared_in_branch",
+ "description": "Existing code scanning alerts appeared in a branch.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_number",
+ "commit_oid",
+ "ref",
+ "request_id",
+ "org_id",
+ "org",
+ "business_id",
+ "business",
+ "alert_numbers"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_closed_became_fixed",
+ "description": "Code scanning alerts were fixed.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_number",
+ "commit_oid",
+ "ref",
+ "request_id",
+ "org_id",
+ "org",
+ "business_id",
+ "business",
+ "alert_numbers"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_closed_became_outdated",
+ "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_numbers",
+ "commit_oid",
+ "ref",
+ "request_id",
+ "org_id",
+ "org",
+ "business_id",
+ "business"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_closed_by_user",
+ "description": "Code scanning alerts were manually dismissed.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_number",
+ "actor_id",
+ "request_id",
+ "actor",
+ "org_id",
+ "org",
+ "business_id",
+ "business",
+ "alert_numbers",
+ "dismissal_approver_id"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_closure_approved",
+ "description": "Dismissal of code scanning alerts was approved.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "dismissal_request_id",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_closure_denied",
+ "description": "Dismissal of code scanning alerts was denied.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "dismissal_request_id",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_closure_requested",
+ "description": "Dismissal of code scanning alerts was requested.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "dismissal_request_id",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_created",
+ "description": "Code scanning alerts were seen for the first time.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_number",
+ "commit_oid",
+ "ref",
+ "request_id",
+ "org_id",
+ "org",
+ "alert_numbers"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_reappeared",
+ "description": "Code scanning alerts that were previously fixed reappeared.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_number",
+ "commit_oid",
+ "ref",
+ "request_id",
+ "org_id",
+ "org",
+ "business_id",
+ "business",
+ "alert_numbers"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_reopened_by_user",
+ "description": "Code scanning alerts that were previously dismissed were reopened.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_number",
+ "actor_id",
+ "request_id",
+ "actor",
+ "org_id",
+ "org",
+ "business_id",
+ "business",
+ "alert_numbers"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "codespaces.allow_permissions",
+ "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "origin_repository",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "codespaces.connect",
+ "description": "Credentials for a codespace were refreshed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repository_id",
+ "repository",
+ "pull_request_id",
+ "user_id",
+ "org_id",
+ "owner",
+ "name",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "machine_type",
+ "devcontainer_path"
+ ]
+ },
+ {
+ "action": "codespaces.create",
+ "description": "A codespace was created",
+ "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repository_id",
+ "repository",
+ "pull_request_id",
+ "owner",
+ "name",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "machine_type",
+ "devcontainer_path"
+ ],
+ "docs_reference_titles": "Creating a codespace for a repository"
+ },
+ {
+ "action": "codespaces.destroy",
+ "description": "A user deleted a codespace.",
+ "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repository_id",
+ "repository",
+ "pull_request_id",
+ "owner",
+ "name",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Deleting a codespace"
+ },
+ {
+ "action": "codespaces.export_environment",
+ "description": "A codespace was exported to a branch on GitHub.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "owner",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo"
+ ]
+ },
+ {
+ "action": "codespaces.restore",
+ "description": "A codespace was restored.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "codespaces.start_environment",
+ "description": "A codespace was started.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "org",
+ "owner",
+ "pull_request_id",
+ "machine_type",
+ "user_id",
+ "user",
+ "devcontainer_path",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "codespaces.suspend_environment",
+ "description": "A codespace was stopped.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "codespaces.trusted_repositories_access_update",
+ "description": "A personal account's access and security setting for Codespaces were updated.",
+ "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "business",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Managing access to other repositories within your codespace"
+ },
+ {
+ "action": "copilot.cfb_seat_added",
+ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "token_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_assignment_created",
+ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
+ "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "What is GitHub Copilot?"
+ },
+ {
+ "action": "copilot.cfb_seat_assignment_refreshed",
+ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_assignment_reused",
+ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_assignment_unassigned",
+ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_cancelled",
+ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "seat_assignment",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_cancelled_by_staff",
+ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user_id",
+ "user",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "copilot.swe_agent_repo_disabled",
+ "description": "Specific repositories were disabled from using Copilot coding agent.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "org_id",
+ "owner_type",
+ "actor_id",
+ "owner",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "copilot.swe_agent_repo_enabled",
+ "description": "Specific repositories were enabled to use Copilot coding agent.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "org_id",
+ "owner_type",
+ "owner",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "copilot.swe_agent_repo_enablement_updated",
+ "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "new_access",
+ "old_access",
+ "org_id",
+ "owner_type",
+ "owner",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "custom_hosted_runner.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "runner_group_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "custom_hosted_runner.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "custom_hosted_runner.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "runner_group_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "custom_property_definition.create",
+ "description": "A new custom property definition was created.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "property_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "value_type",
+ "required",
+ "default_value",
+ "definition_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
+ },
+ {
+ "action": "custom_property_definition.destroy",
+ "description": "A custom property definition was deleted.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "property_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "value_type",
+ "required",
+ "default_value",
+ "definition_id",
+ "allowed_values"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
+ },
+ {
+ "action": "custom_property_definition.update",
+ "description": "A custom property definition was updated.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "property_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "value_type",
+ "required",
+ "default_value",
+ "old_allowed_values",
+ "allowed_values",
+ "definition_id",
+ "old_required",
+ "old_default_value",
+ "old_value_type",
+ "old_values_editable_by",
+ "values_editable_by",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
+ },
+ {
+ "action": "custom_property_value.create",
+ "description": "A repository's custom property value was manually set for the first time.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "definition_id",
+ "property_name",
+ "value",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
+ },
+ {
+ "action": "custom_property_value.destroy",
+ "description": "A repository's custom property value was deleted.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repository",
+ "repository_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
+ },
+ {
+ "action": "custom_property_value.update",
+ "description": "A repository's custom property value was updated.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repository",
+ "repository_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "definition_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
+ },
+ {
+ "action": "dependabot_alerts.disable",
+ "description": "Dependabot alerts were disabled for all existing repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
+ },
+ {
+ "action": "dependabot_alerts.enable",
+ "description": "Dependabot alerts were enabled for all existing repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
+ },
+ {
+ "action": "dependabot_alerts_new_repos.disable",
+ "description": "Dependabot alerts were disabled for all new repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
+ },
+ {
+ "action": "dependabot_alerts_new_repos.enable",
+ "description": "Dependabot alerts were enabled for all new repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
+ },
+ {
+ "action": "dependabot_repository_access.default_access_level_updated",
+ "description": "The default repository access for Dependabot was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "org",
+ "org_id",
+ "access_level",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "dependabot_repository_access.repositories_updated",
+ "description": "The repositories that Dependabot can access were updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "dependabot_security_updates.disable",
+ "description": "Dependabot security updates were disabled for all existing repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+ },
+ {
+ "action": "dependabot_security_updates.enable",
+ "description": "Dependabot security updates were enabled for all existing repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "dependabot_security_updates_new_repos.disable",
+ "description": " Dependabot security updates were disabled for all new repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+ },
+ {
+ "action": "dependabot_security_updates_new_repos.enable",
+ "description": "Dependabot security updates were enabled for all new repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "dependency_graph.disable",
+ "description": "The dependency graph was disabled for all existing repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+ },
+ {
+ "action": "dependency_graph.enable",
+ "description": "The dependency graph was enabled for all existing repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "dependency_graph_new_repos.disable",
+ "description": "The dependency graph was disabled for all new repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+ },
+ {
+ "action": "dependency_graph_new_repos.enable",
+ "description": "The dependency graph was enabled for all new repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "discussion_post.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "team",
+ "created_at",
+ "user_id",
+ "@timestamp",
+ "number",
+ "org",
+ "title",
+ "actor",
+ "actor_id",
+ "user",
+ "action",
+ "user_agent",
+ "operation_type",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "discussion_post_reply.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "operation_type",
+ "user_id",
+ "actor",
+ "number",
+ "user",
+ "created_at",
+ "request_id",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "discussion_post_reply.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "_document_id",
+ "request_id",
+ "org",
+ "@timestamp",
+ "actor_id",
+ "operation_type",
+ "user",
+ "user_id",
+ "org_id",
+ "user_agent",
+ "actor",
+ "number",
+ "team",
+ "created_at"
+ ]
+ },
+ {
+ "action": "discussion_post.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "_document_id",
+ "title",
+ "user",
+ "user_agent",
+ "org",
+ "operation_type",
+ "actor_id",
+ "@timestamp",
+ "actor",
+ "team",
+ "action",
+ "org_id",
+ "request_id",
+ "user_id",
+ "number"
+ ]
+ },
+ {
+ "action": "enterprise_announcement.create",
+ "description": "A global announcement banner was created for the enterprise.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "owner",
+ "owner_type",
+ "business_id",
+ "message",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Customizing user messages for your enterprise"
+ },
+ {
+ "action": "enterprise_announcement.destroy",
+ "description": "A global announcement banner was removed from the enterprise.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "owner",
+ "owner_type",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Customizing user messages for your enterprise"
+ },
+ {
+ "action": "enterprise_announcement.update",
+ "description": "A global announcement banner was updated for the enterprise.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "owner",
+ "owner_type",
+ "business_id",
+ "message",
+ "old_message",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Customizing user messages for your enterprise"
+ },
+ {
+ "action": "enterprise.configure_self_hosted_jit_runner",
+ "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
+ "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise"
+ },
+ {
+ "action": "enterprise_domain.approve",
+ "description": "A domain was approved for an enterprise.",
+ "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner_type",
+ "domain_name",
+ "business_id",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Verifying or approving a domain for your enterprise"
+ },
+ {
+ "action": "enterprise_domain.create",
+ "description": "A domain was added to an enterprise.",
+ "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "owner_type",
+ "domain_name",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Verifying or approving a domain for your enterprise"
+ },
+ {
+ "action": "enterprise_domain.destroy",
+ "description": "A domain was removed from an enterprise.",
+ "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "owner_type",
+ "domain_name",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Verifying or approving a domain for your enterprise"
+ },
+ {
+ "action": "enterprise_domain.verify",
+ "description": "A domain was verified for an enterprise.",
+ "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner_type",
+ "domain_name",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Verifying or approving a domain for your enterprise"
+ },
+ {
+ "action": "enterprise.register_self_hosted_runner",
+ "description": "A new GitHub Actions self-hosted runner was registered.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Adding self-hosted runners"
+ },
+ {
+ "action": "enterprise.remove_self_hosted_runner",
+ "description": "A GitHub Actions self-hosted runner was removed.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Removing self-hosted runners"
+ },
+ {
+ "action": "enterprise_role.assign",
+ "description": "An enterprise role was assigned to a user or enterprise team.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "enterprise_role_id",
+ "enterprise_role_name",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Abilities of roles in an enterprise"
+ },
+ {
+ "action": "enterprise_role.create",
+ "description": "A custom enterprise role was created in an enterprise.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "name",
+ "owner",
+ "role_permissions",
+ "base_role",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Abilities of roles in an enterprise"
+ },
+ {
+ "action": "enterprise_role.destroy",
+ "description": "A custom enterprise role was deleted in an enterprise.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "name",
+ "owner",
+ "role_permissions",
+ "base_role",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Abilities of roles in an enterprise"
+ },
+ {
+ "action": "enterprise_role.revoke",
+ "description": "A user or enterprise team was unassigned an enterprise role.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "enterprise_role_id",
+ "enterprise_role_name",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Abilities of roles in an enterprise"
+ },
+ {
+ "action": "enterprise_role.update",
+ "description": "A custom enterprise role was edited in an enterprise.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "name",
+ "owner",
+ "role_permissions",
+ "base_role",
+ "old_role_permissions",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Abilities of roles in an enterprise"
+ },
+ {
+ "action": "enterprise.runner_group_created",
+ "description": "A GitHub Actions self-hosted runner group was created.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "runner_group_restricted_to_workflows"
+ ],
+ "docs_reference_titles": "Removing self-hosted runners"
+ },
+ {
+ "action": "enterprise.runner_group_removed",
+ "description": "A GitHub Actions self-hosted runner group was removed.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Managing access to self-hosted runners using groups"
+ },
+ {
+ "action": "enterprise.runner_group_runner_removed",
+ "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
+ "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "runner_group_id",
+ "runner_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
+ },
+ {
+ "action": "enterprise.runner_group_runners_added",
+ "description": "A GitHub Actions self-hosted runner was added to a group.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing access to self-hosted runners using groups"
+ },
+ {
+ "action": "enterprise.runner_group_runners_updated",
+ "description": "A GitHub Actions runner group's list of members was updated.",
+ "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "runner_group_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
+ },
+ {
+ "action": "enterprise.runner_group_updated",
+ "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "runner_group_name",
+ "runner_group_allow_public",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "runner_group_restricted_to_workflows",
+ "runner_group_selected_workflow_refs",
+ "network_configuration_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing access to self-hosted runners using groups"
+ },
+ {
+ "action": "enterprise.self_hosted_runner_offline",
+ "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
+ "fields": [
+ "business_id",
+ "runner_id",
+ "runner_name",
+ "action",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+ },
+ {
+ "action": "enterprise.self_hosted_runner_online",
+ "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
+ "fields": [
+ "business_id",
+ "runner_id",
+ "runner_name",
+ "action",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+ },
+ {
+ "action": "enterprise.self_hosted_runner_updated",
+ "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
+ "fields": [
+ "business_id",
+ "runner_id",
+ "runner_name",
+ "source_version",
+ "target_version",
+ "runner_group_id",
+ "runner_group_name",
+ "action",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Self-hosted runners"
+ },
+ {
+ "action": "enterprise_team.add_member",
+ "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user_id",
+ "business_id",
+ "enterprise_team_id",
+ "enterprise_team",
+ "user",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "enterprise_team.copilot_assignment",
+ "description": "A license for GitHub Copilot was assigned to an enterprise team.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business_id",
+ "enterprise_team_id",
+ "enterprise_team",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "enterprise_team.copilot_unassignment",
+ "description": "A license for GitHub Copilot was unassigned from an enterprise team.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business_id",
+ "enterprise_team_id",
+ "enterprise_team",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "enterprise_team.create",
+ "description": "A new enterprise team was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business_id",
+ "enterprise_team_id",
+ "enterprise_team",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "enterprise_team.destroy",
+ "description": "An enterprise team was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business_id",
+ "enterprise_team_id",
+ "enterprise_team",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "enterprise_team.remove_member",
+ "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user_id",
+ "business_id",
+ "enterprise_team_id",
+ "enterprise_team",
+ "user",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "enterprise_team.rename",
+ "description": "The name of an enterprise team was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "business_id",
+ "enterprise_team_id",
+ "enterprise_team",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "environment.add_protection_rule",
+ "description": "A GitHub Actions deployment protection rule was created via the API.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "environment_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "environment.create_actions_secret",
+ "description": "A secret was created for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "key",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.create_actions_variable",
+ "description": "A variable was created for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "environment_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "environment.delete",
+ "description": "An environment was deleted.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.remove_actions_secret",
+ "description": "A secret was deleted for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "key",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "public_repo",
+ "token_scopes",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.remove_actions_variable",
+ "description": "A variable was deleted for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "environment_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "environment.remove_protection_rule",
+ "description": "A GitHub Actions deployment protection rule was deleted via the API.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.update_actions_secret",
+ "description": "A secret was updated for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "key",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.update_actions_variable",
+ "description": "A variable was updated for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "environment_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "environment.update_protection_rule",
+ "description": "A GitHub Actions deployment protection rule was updated via the API.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "new_value",
+ "approvers_was",
+ "approvers",
+ "programmatic_access_type",
+ "can_admins_bypass",
+ "prevent_self_review"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "external_group.add_member",
+ "description": "A user was added to an external group.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "external_group",
+ "external_group_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "scim_group_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "external_group.delete",
+ "description": "An external group was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes",
+ "scim_group_id"
+ ]
+ },
+ {
+ "action": "external_group.link",
+ "description": "An external group was linked to a GitHub team.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "external_group_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "external_group",
+ "programmatic_access_type",
+ "scim_group_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "external_group.provision",
+ "description": "An external group was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "external_group.remove_member",
+ "description": "A user was removed from an external group.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "external_group",
+ "external_group_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "external_group.scim_api_failure",
+ "description": "Failed external group SCIM API request.",
+ "docs_reference_links": "/rest/scim/scim",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_method",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "query_string",
+ "api_request_body",
+ "route",
+ "status_code",
+ "url_path",
+ "scim_group_id",
+ "message",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "REST API endpoints for SCIM"
+ },
+ {
+ "action": "external_group.scim_api_success",
+ "description": "Successful external group SCIM API request. Excludes GET API requests.",
+ "docs_reference_links": "/rest/scim/scim",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_method",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "query_string",
+ "api_request_body",
+ "route",
+ "status_code",
+ "url_path",
+ "scim_group_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "REST API endpoints for SCIM"
+ },
+ {
+ "action": "external_group.unlink",
+ "description": "An external group was unlinked to a GitHub team.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "external_group_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "external_group"
+ ]
+ },
+ {
+ "action": "external_group.update",
+ "description": "An external group was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "scim_group_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "external_group.update_display_name",
+ "description": "An external group's display name was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "external_group_id",
+ "external_group",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "scim_group_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "external_identity.deprovision",
+ "description": "An external identity was deprovisioned, suspending the linked GitHub user.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "action",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "external_identity.provision",
+ "description": "An external identity was created and linked to a GitHub user.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "action",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "scim_user_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "external_identity.scim_api_failure",
+ "description": "Failed external identity SCIM API request.",
+ "docs_reference_links": "/rest/scim/scim",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_method",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "query_string",
+ "api_request_body",
+ "route",
+ "status_code",
+ "url_path",
+ "scim_user_id",
+ "message",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "REST API endpoints for SCIM"
+ },
+ {
+ "action": "external_identity.scim_api_success",
+ "description": "Successful external identity SCIM API request. Excludes GET API requests.",
+ "docs_reference_links": "/rest/scim/scim",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_method",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "query_string",
+ "api_request_body",
+ "route",
+ "status_code",
+ "url_path",
+ "scim_user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "REST API endpoints for SCIM"
+ },
+ {
+ "action": "external_identity.update",
+ "description": "An external identity was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "action",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "scim_user_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "gist.create",
+ "description": "A gist was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "user_id",
+ "user",
+ "gist_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "visibility",
+ "action",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "gist.destroy",
+ "description": "A gist was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "gist_id",
+ "visibility",
+ "created_at",
+ "_document_id",
+ "user",
+ "request_id",
+ "operation_type",
+ "actor",
+ "actor_id",
+ "action",
+ "user_agent",
+ "@timestamp",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "gist.visibility_change",
+ "description": "The visibility of a gist was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "actor",
+ "user",
+ "gist_id",
+ "actor_id",
+ "request_id",
+ "visibility",
+ "user_id",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "git.clone",
+ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "transport_protocol",
+ "request_id",
+ "repository",
+ "repository_id",
+ "repository_public",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "transport_protocol_name"
+ ]
+ },
+ {
+ "action": "git.fetch",
+ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "transport_protocol",
+ "request_id",
+ "repository",
+ "repository_id",
+ "repository_public",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "transport_protocol_name"
+ ]
+ },
+ {
+ "action": "git.push",
+ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "transport_protocol",
+ "request_id",
+ "repository",
+ "repository_id",
+ "repository_public",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "transport_protocol_name"
+ ]
+ },
+ {
+ "action": "git_signing_ssh_public_key.create",
+ "description": "An SSH key was added to a user account as a Git commit signing key.",
+ "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "key",
+ "fingerprint",
+ "user_id",
+ "user",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
+ },
+ {
+ "action": "git_signing_ssh_public_key.delete",
+ "description": "An SSH key was removed from a user account as a Git commit signing key.",
+ "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "key",
+ "fingerprint",
+ "user_id",
+ "explanation",
+ "user",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
+ },
+ {
+ "action": "github_hosted_runner.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "runner_group_id",
+ "business",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "github_hosted_runner.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "github_hosted_runner.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "runner_group_id",
+ "business",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "gpg_key.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "created_at",
+ "user_id",
+ "@timestamp",
+ "user",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "action",
+ "user_agent",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "gpg_key.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "operation_type",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "action",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "@timestamp",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "hook.active_changed",
+ "description": "A hook's active status was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "name",
+ "events",
+ "active",
+ "active_was",
+ "hook_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "hook.config_changed",
+ "description": "A hook's configuration was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "name",
+ "org",
+ "user_agent",
+ "request_id",
+ "hook_id",
+ "repo",
+ "repo_id",
+ "created_at",
+ "oauth_application_id",
+ "action",
+ "events",
+ "org_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "hook.create",
+ "description": "A new hook was added.",
+ "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
+ "fields": [
+ "oauth_application",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "repo_id",
+ "request_id",
+ "hook_id",
+ "events",
+ "repo",
+ "@timestamp",
+ "operation_type",
+ "name",
+ "action",
+ "created_at",
+ "org_id",
+ "org",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "About webhooks"
+ },
+ {
+ "action": "hook.destroy",
+ "description": "A hook was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "events",
+ "repo",
+ "created_at",
+ "org",
+ "name",
+ "request_id",
+ "actor_id",
+ "repo_id",
+ "org_id",
+ "action",
+ "operation_type",
+ "oauth_application_id",
+ "user_agent",
+ "hook_id",
+ "@timestamp",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "hook.events_changed",
+ "description": "A hook's configured events were changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "events",
+ "repo",
+ "operation_type",
+ "action",
+ "_document_id",
+ "actor_id",
+ "name",
+ "events_were",
+ "@timestamp",
+ "created_at",
+ "hook_id",
+ "repo_id",
+ "org_id",
+ "org",
+ "user_agent",
+ "request_id",
+ "oauth_application_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "integration.create",
+ "description": "A GitHub App was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "actor",
+ "user_agent",
+ "actor_id",
+ "request_id",
+ "name",
+ "user_id",
+ "_document_id",
+ "integration",
+ "created_at",
+ "programmatic_access_type",
+ "request_access_security_header",
+ "application_client_id"
+ ]
+ },
+ {
+ "action": "integration.destroy",
+ "description": "A GitHub App was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "user_id",
+ "actor_id",
+ "request_id",
+ "@timestamp",
+ "name",
+ "integration",
+ "user",
+ "_document_id",
+ "action",
+ "operation_type",
+ "created_at",
+ "user_agent"
+ ]
+ },
+ {
+ "action": "integration.generate_client_secret",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "integration",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header",
+ "application_client_id"
+ ]
+ },
+ {
+ "action": "integration_installation.create",
+ "description": "A GitHub App was installed.",
+ "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
+ "fields": [
+ "operation_type",
+ "@timestamp",
+ "name",
+ "request_id",
+ "repository_selection",
+ "user_id",
+ "action",
+ "user_agent",
+ "user",
+ "created_at",
+ "integration",
+ "_document_id",
+ "programmatic_access_type",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
+ },
+ {
+ "action": "integration_installation.destroy",
+ "description": "A GitHub App was uninstalled.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
+ "fields": [
+ "@timestamp",
+ "request_id",
+ "actor",
+ "created_at",
+ "_document_id",
+ "repository_selection",
+ "integration",
+ "user_id",
+ "user",
+ "action",
+ "operation_type",
+ "name",
+ "actor_id",
+ "user_agent",
+ "programmatic_access_type",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
+ },
+ {
+ "action": "integration_installation.repositories_added",
+ "description": "Repositories were added to a GitHub App.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
+ "fields": [
+ "user_id",
+ "repository_selection",
+ "name",
+ "user",
+ "request_id",
+ "integration",
+ "operation_type",
+ "actor_id",
+ "action",
+ "repositories_added",
+ "created_at",
+ "_document_id",
+ "@timestamp",
+ "actor",
+ "user_agent",
+ "token_scopes",
+ "repositories_added_names",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
+ },
+ {
+ "action": "integration_installation.repositories_removed",
+ "description": "Repositories were removed from a GitHub App.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
+ "fields": [
+ "user",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "repository_selection",
+ "repositories_removed",
+ "integration",
+ "user_id",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "@timestamp",
+ "name",
+ "action",
+ "actor_id",
+ "repositories_removed_names",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
+ },
+ {
+ "action": "integration_installation_request.close",
+ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
+ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
+ "fields": [
+ "url",
+ "actor",
+ "actor_id",
+ "created_at",
+ "request_id",
+ "operation_type",
+ "@timestamp",
+ "integration",
+ "action",
+ "user_agent",
+ "reason",
+ "_document_id",
+ "org",
+ "org_id",
+ "request_access_security_header",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
+ },
+ {
+ "action": "integration_installation_request.create",
+ "description": "A member requested that an owner install a GitHub App.",
+ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
+ "fields": [
+ "@timestamp",
+ "actor_id",
+ "org",
+ "_document_id",
+ "requester",
+ "action",
+ "user_agent",
+ "created_at",
+ "url",
+ "org_id",
+ "request_id",
+ "operation_type",
+ "actor",
+ "integration",
+ "request_access_security_header",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
+ },
+ {
+ "action": "integration_installation.suspend",
+ "description": "A GitHub App was suspended.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "name",
+ "repository_selection",
+ "actor_id",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
+ },
+ {
+ "action": "integration_installation.unsuspend",
+ "description": "A GitHub App was unsuspended.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "name",
+ "repository_selection",
+ "actor_id",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
+ },
+ {
+ "action": "integration_installation.version_updated",
+ "description": "Permissions for a GitHub App were updated.",
+ "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
+ "fields": [
+ "integration",
+ "user_id",
+ "user_agent",
+ "name",
+ "user",
+ "operation_type",
+ "actor_id",
+ "action",
+ "_document_id",
+ "request_id",
+ "created_at",
+ "repository_selection",
+ "@timestamp",
+ "actor",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
+ },
+ {
+ "action": "integration.manager_added",
+ "description": "A member of an enterprise or organization was added as a GitHub App manager.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
+ "fields": [
+ "created_at",
+ "action",
+ "_document_id",
+ "name",
+ "org_id",
+ "manager",
+ "operation_type",
+ "actor",
+ "integration",
+ "org",
+ "@timestamp",
+ "actor_id",
+ "request_id",
+ "user_agent"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
+ },
+ {
+ "action": "integration.manager_removed",
+ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "org",
+ "operation_type",
+ "integration",
+ "org_id",
+ "_document_id",
+ "action",
+ "actor",
+ "name",
+ "created_at",
+ "manager",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
+ },
+ {
+ "action": "integration.remove_client_secret",
+ "description": "A client secret for a GitHub App was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "integration.revoke_all_tokens",
+ "description": "All user tokens for a GitHub App were requested to be revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "application_client_id"
+ ]
+ },
+ {
+ "action": "integration.revoke_tokens",
+ "description": "Token(s) for a GitHub App were revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "application_client_id"
+ ]
+ },
+ {
+ "action": "integration.suspend",
+ "description": "A GitHub App was suspended.",
+ "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
+ },
+ {
+ "action": "integration.transfer",
+ "description": "Ownership of a GitHub App was transferred to another user or organization.",
+ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
+ "fields": [
+ "@timestamp",
+ "user_id",
+ "name",
+ "transfer_to_id",
+ "user",
+ "requester",
+ "action",
+ "requester_id",
+ "actor_id",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "transfer_to",
+ "operation_type",
+ "request_id",
+ "actor",
+ "integration",
+ "transfer_from",
+ "transfer_from_id",
+ "transfer_from_type",
+ "transfer_to_type"
+ ],
+ "docs_reference_titles": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
+ },
+ {
+ "action": "integration.unsuspend",
+ "description": "A GitHub App was unsuspended.",
+ "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
+ },
+ {
+ "action": "ip_allow_list.disable",
+ "description": "An IP allow list was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "actor",
+ "request_id",
+ "org",
+ "user_agent",
+ "_document_id",
+ "user_id",
+ "actor_id",
+ "created_at",
+ "org_id",
+ "action",
+ "@timestamp",
+ "user"
+ ]
+ },
+ {
+ "action": "ip_allow_list.disable_for_installed_apps",
+ "description": "An IP allow list was disabled for installed GitHub Apps.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "ip_allow_list.disable_user_level_enforcement",
+ "description": "IP allow list user level enforcement was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "ip_allow_list.enable",
+ "description": "An IP allow list was enabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "business",
+ "user_id",
+ "request_id",
+ "actor",
+ "user",
+ "business_id",
+ "_document_id",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "actor_id",
+ "operation_type",
+ "org",
+ "created_at"
+ ]
+ },
+ {
+ "action": "ip_allow_list.enable_for_installed_apps",
+ "description": "An IP allow list was enabled for installed GitHub Apps.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "ip_allow_list.enable_user_level_enforcement",
+ "description": "IP allow list user level enforcement was enabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "ip_allow_list_entry.create",
+ "description": "An IP address was added to an IP allow list.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "active",
+ "org",
+ "ip_allow_list_entry",
+ "@timestamp",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "action",
+ "request_id",
+ "actor_id",
+ "business_id",
+ "org_id",
+ "business",
+ "actor",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "ip_allow_list_entry.destroy",
+ "description": "An IP address was deleted from an IP allow list.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "request_id",
+ "ip_allow_list_entry",
+ "org",
+ "operation_type",
+ "created_at",
+ "active",
+ "action",
+ "@timestamp",
+ "business",
+ "business_id",
+ "user_agent",
+ "org_id",
+ "actor",
+ "actor_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "ip_allow_list_entry.update",
+ "description": "An IP address or its description was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "_document_id",
+ "actor",
+ "org",
+ "action",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "actor_id",
+ "ip_allow_list_entry",
+ "active",
+ "org_id",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "issue_dependencies.blocked_by_add",
+ "description": "An issue was marked as blocked by another issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_dependencies.blocked_by_remove",
+ "description": "The blocked by relationship between an issue and another issue was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "title",
+ "org",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "issue_dependencies.blocking_add",
+ "description": "An issue was marked as blocking another issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_dependencies.blocking_remove",
+ "description": "The blocking relationship between an issue and another issue was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "marketplace_agreement_signature.create",
+ "description": "The GitHub Marketplace Developer Agreement was signed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "operation_type",
+ "created_at",
+ "action",
+ "user",
+ "user_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "marketplace_listing.approve",
+ "description": "A listing was approved for inclusion in GitHub Marketplace.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "secondary_category",
+ "actor",
+ "primary_category",
+ "user",
+ "@timestamp",
+ "_document_id",
+ "user_id",
+ "user_agent",
+ "operation_type",
+ "created_at",
+ "request_id",
+ "actor_id",
+ "marketplace_listing",
+ "integration",
+ "action"
+ ]
+ },
+ {
+ "action": "marketplace_listing.change_category",
+ "description": "A category for a listing for an app in GitHub Marketplace was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "primary_category",
+ "user_agent",
+ "request_id",
+ "actor",
+ "marketplace_listing",
+ "@timestamp",
+ "integration",
+ "org_id",
+ "action",
+ "org",
+ "secondary_category",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "marketplace_listing.create",
+ "description": "A listing for an app in GitHub Marketplace was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "primary_category",
+ "_document_id",
+ "user",
+ "created_at",
+ "user_agent",
+ "oauth_application",
+ "action",
+ "request_id",
+ "marketplace_listing",
+ "user_id",
+ "secondary_category",
+ "oauth_application_id",
+ "actor",
+ "actor_id",
+ "operation_type",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "marketplace_listing.delist",
+ "description": "A listing was removed from GitHub Marketplace.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org_id",
+ "created_at",
+ "secondary_category",
+ "operation_type",
+ "marketplace_listing",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "primary_category",
+ "integration"
+ ]
+ },
+ {
+ "action": "marketplace_listing_plan.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "created_at",
+ "actor",
+ "action",
+ "operation_type",
+ "marketplace_listing",
+ "has_free_trial",
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "yearly_price_in_cents",
+ "description",
+ "bullets",
+ "monthly_price_in_cents",
+ "marketplace_listing_plan",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "marketplace_listing_plan.publish",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "marketplace_listing_plan",
+ "marketplace_listing",
+ "description",
+ "bullets",
+ "has_free_trial",
+ "created_at",
+ "actor_id",
+ "operation_type",
+ "_document_id",
+ "action",
+ "user_agent",
+ "request_id",
+ "actor",
+ "monthly_price_in_cents",
+ "yearly_price_in_cents",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "marketplace_listing_plan.retire",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "marketplace_listing_plan",
+ "_document_id",
+ "request_id",
+ "description",
+ "yearly_price_in_cents",
+ "@timestamp",
+ "created_at",
+ "actor_id",
+ "bullets",
+ "has_free_trial",
+ "marketplace_listing",
+ "user_agent",
+ "monthly_price_in_cents",
+ "action",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "marketplace_listing_plan.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "monthly_price_in_cents",
+ "marketplace_listing",
+ "_document_id",
+ "action",
+ "description",
+ "bullets",
+ "yearly_price_in_cents",
+ "request_id",
+ "actor_id",
+ "has_free_trial",
+ "marketplace_listing_plan",
+ "user_agent",
+ "@timestamp",
+ "operation_type",
+ "actor",
+ "created_at"
+ ]
+ },
+ {
+ "action": "marketplace_listing.redraft",
+ "description": "A listing was sent back to draft state.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "secondary_category",
+ "oauth_application_id",
+ "@timestamp",
+ "action",
+ "user_agent",
+ "user_id",
+ "operation_type",
+ "oauth_application",
+ "actor",
+ "created_at",
+ "marketplace_listing",
+ "request_id",
+ "actor_id",
+ "primary_category",
+ "user"
+ ]
+ },
+ {
+ "action": "marketplace_listing.reject",
+ "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "primary_category",
+ "secondary_category",
+ "marketplace_listing",
+ "oauth_application",
+ "oauth_application_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "merge_queue.pull_request_dequeued",
+ "description": "A pull request was removed from a merge queue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "public_repo",
+ "repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "merge_queue.pull_request_queue_jump",
+ "description": "A pull request was moved ahead in a merge queue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo_id",
+ "public_repo",
+ "repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "merge_queue.queue_cleared",
+ "description": "A merge queue was cleared.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "public_repo",
+ "repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "merge_queue.update_settings",
+ "description": "The settings for a merge queue were updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "max_entries_to_build",
+ "min_entries_to_merge",
+ "repo_id",
+ "public_repo",
+ "repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "metered_billing_configuration.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "@timestamp",
+ "_document_id",
+ "user_id",
+ "action",
+ "operation_type",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "metered_billing_configuration.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "metered_billing_configuration.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "org",
+ "created_at",
+ "operation_type",
+ "org_id",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "actor",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "migration.create",
+ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "org_id",
+ "_document_id",
+ "org",
+ "repo_id",
+ "action",
+ "actor",
+ "created_at",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "oauth_access.create",
+ "description": "An OAuth access token was generated.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
+ "fields": [
+ "_document_id",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "@timestamp",
+ "user",
+ "user_id",
+ "created_at",
+ "action",
+ "actor_id",
+ "request_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header",
+ "oauth_application_name"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
+ },
+ {
+ "action": "oauth_access.destroy",
+ "description": "An OAuth access token was deleted.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
+ "fields": [
+ "@timestamp",
+ "user_agent",
+ "action",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "created_at",
+ "user",
+ "user_id",
+ "request_id",
+ "explanation",
+ "hashed_token",
+ "actor_id",
+ "token_scopes",
+ "oauth_application_name"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
+ },
+ {
+ "action": "oauth_access.regenerate",
+ "description": "An OAuth access token was regenerated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "user_id",
+ "_document_id",
+ "created_at",
+ "@timestamp",
+ "operation_type",
+ "action",
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "oauth_application_name"
+ ]
+ },
+ {
+ "action": "oauth_access.revoke",
+ "description": "An OAuth access token was revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "token_id",
+ "token_scopes",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "oauth_access.update",
+ "description": "An OAuth access token was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "actor",
+ "operation_type",
+ "_document_id",
+ "user_id",
+ "created_at",
+ "action",
+ "@timestamp",
+ "user",
+ "user_agent",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "oauth_application.create",
+ "description": "An OAuth application was created.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "org",
+ "created_at",
+ "oauth_application_id",
+ "operation_type",
+ "user_agent",
+ "actor_id",
+ "org_id",
+ "action",
+ "actor",
+ "oauth_application",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.destroy",
+ "description": "An OAuth application was deleted.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "created_at",
+ "oauth_application_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "oauth_application",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "request_id",
+ "action",
+ "user",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.generate_client_secret",
+ "description": "An OAuth application's secret key was generated.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application",
+ "oauth_application_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.remove_client_secret",
+ "description": "An OAuth application's secret key was deleted.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application",
+ "oauth_application_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.reset_secret",
+ "description": "The secret key for an OAuth application was reset.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "user",
+ "user_id",
+ "action",
+ "oauth_application",
+ "operation_type",
+ "request_id",
+ "actor_id",
+ "_document_id",
+ "created_at",
+ "actor",
+ "oauth_application_id",
+ "@timestamp",
+ "user_agent"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.revoke_all_tokens",
+ "description": "All user tokens for an OAuth application were requested to be revoked.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application",
+ "oauth_application_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.revoke_tokens",
+ "description": "Token(s) for an OAuth application were revoked.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "oauth_application_id",
+ "oauth_application",
+ "actor_id",
+ "user_agent",
+ "@timestamp",
+ "request_id",
+ "user_id",
+ "action",
+ "_document_id",
+ "actor",
+ "user",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.suspend",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "user_agent",
+ "org_id",
+ "org",
+ "operation_type",
+ "oauth_application_id",
+ "action",
+ "created_at",
+ "actor",
+ "actor_id",
+ "oauth_application",
+ "_document_id",
+ "request_id"
+ ]
+ },
+ {
+ "action": "oauth_application.transfer",
+ "description": "An OAuth application was transferred from one account to another.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "actor",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "oauth_application",
+ "actor_id",
+ "oauth_application_id",
+ "@timestamp",
+ "user_id",
+ "_document_id",
+ "request_id",
+ "user",
+ "action"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.unsuspend",
+ "description": "An OAuth application was unsuspended for a user or organization account.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "operation_type",
+ "org_id",
+ "action",
+ "oauth_application_id",
+ "oauth_application",
+ "org",
+ "created_at",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_authorization.create",
+ "description": "An authorization for an OAuth application was created.",
+ "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
+ "fields": [
+ "operation_type",
+ "user_agent",
+ "user_id",
+ "actor",
+ "org_id",
+ "_document_id",
+ "request_id",
+ "action",
+ "@timestamp",
+ "created_at",
+ "actor_id",
+ "user",
+ "business",
+ "business_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header",
+ "oauth_application_name"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
+ },
+ {
+ "action": "oauth_authorization.destroy",
+ "description": "An authorization for an OAuth application was deleted.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
+ "fields": [
+ "user_agent",
+ "_document_id",
+ "request_id",
+ "operation_type",
+ "@timestamp",
+ "actor",
+ "created_at",
+ "explanation",
+ "user",
+ "user_id",
+ "org_id",
+ "action",
+ "actor_id",
+ "token_scopes",
+ "actor_is_bot",
+ "oauth_application_name"
+ ],
+ "docs_reference_titles": "Reviewing and revoking authorization of GitHub Apps"
+ },
+ {
+ "action": "oauth_authorization.update",
+ "description": "An authorization for an OAuth application was updated.",
+ "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
+ "fields": [
+ "org_id",
+ "request_id",
+ "user_id",
+ "actor",
+ "actor_id",
+ "user_agent",
+ "@timestamp",
+ "operation_type",
+ "action",
+ "user",
+ "created_at",
+ "_document_id",
+ "actor_is_bot",
+ "request_access_security_header",
+ "oauth_application_name"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
+ },
+ {
+ "action": "org.accept_business_invitation",
+ "description": "An invitation sent to an organization to join an enterprise was accepted.",
+ "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Adding organizations to your enterprise"
+ },
+ {
+ "action": "org.add_billing_manager",
+ "description": "A billing manager was added to an organization.",
+ "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
+ "fields": [
+ "operation_type",
+ "_document_id",
+ "user_agent",
+ "org",
+ "user_id",
+ "action",
+ "created_at",
+ "org_id",
+ "user",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "request_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
+ },
+ {
+ "action": "org.add_member",
+ "description": "A user joined an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "permission",
+ "_document_id",
+ "org",
+ "operation_type",
+ "request_id",
+ "actor",
+ "user",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "org_id",
+ "user_id",
+ "actor_id",
+ "action",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "org.add_outside_collaborator",
+ "description": "An outside collaborator was added to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "inviter",
+ "org",
+ "org_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "permission",
+ "invitee",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.add_security_manager",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org_id",
+ "org",
+ "team",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "org.advanced_security_disabled_for_new_repos",
+ "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org.advanced_security_disabled_on_all_repos",
+ "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org.advanced_security_enabled_for_new_repos",
+ "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org.advanced_security_enabled_on_all_repos",
+ "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org.advanced_security_entity_policy_update",
+ "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "new_policy",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
+ },
+ {
+ "action": "org.advanced_security_policy_selected_member_disabled",
+ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
+ },
+ {
+ "action": "org.advanced_security_policy_selected_member_enabled",
+ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
+ },
+ {
+ "action": "org.async_delete",
+ "description": "A user initiated a background job to delete an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "request_id",
+ "org",
+ "org_id",
+ "user_agent",
+ "created_at"
+ ]
+ },
+ {
+ "action": "org.billing_signup_error",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "request_id",
+ "user_agent",
+ "action",
+ "@timestamp",
+ "actor_id",
+ "org_id",
+ "_document_id",
+ "actor",
+ "org",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.block_user",
+ "description": "An organization owner blocked a user from accessing the organization's repositories.",
+ "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
+ "fields": [
+ "actor",
+ "user_agent",
+ "org_id",
+ "created_at",
+ "_document_id",
+ "blocked_user",
+ "action",
+ "operation_type",
+ "actor_id",
+ "org",
+ "@timestamp",
+ "request_id"
+ ],
+ "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
+ },
+ {
+ "action": "org.cancel_business_invitation",
+ "description": "An invitation for an organization to join an enterprise was revoked",
+ "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "initiated_from"
+ ],
+ "docs_reference_titles": "Adding organizations to your enterprise"
+ },
+ {
+ "action": "org.cancel_invitation",
+ "description": "An invitation sent to a user to join an organization was revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "org_id",
+ "request_id",
+ "email",
+ "@timestamp",
+ "actor",
+ "action",
+ "operation_type",
+ "user_agent",
+ "org",
+ "invitation_id",
+ "_document_id",
+ "created_at",
+ "invitee_email",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "org.clear_custom_invitation_rate_limit",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "org.code_scanning_autofix_disabled",
+ "description": "Autofix for code scanning alerts was disabled for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.code_scanning_autofix_enabled",
+ "description": "Autofix for code scanning alerts was enabled for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.code_scanning_autofix_third_party_tools_disabled",
+ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.code_scanning_autofix_third_party_tools_enabled",
+ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.codeql_disabled",
+ "description": "Code scanning using the default setup was disabled for an organization.",
+ "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
+ },
+ {
+ "action": "org.codeql_enabled",
+ "description": "Code scanning using the default setup was enabled for an organization.",
+ "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
+ },
+ {
+ "action": "org.config.disable_collaborators_only",
+ "description": "The interaction limit for collaborators only for an organization was disabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
+ "fields": [
+ "request_id",
+ "org",
+ "action",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "user_agent",
+ "org_id",
+ "created_at"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
+ },
+ {
+ "action": "org.config.disable_contributors_only",
+ "description": "The interaction limit for prior contributors only for an organization was disabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
+ "fields": [
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "action",
+ "actor_id",
+ "org",
+ "_document_id",
+ "actor",
+ "org_id",
+ "request_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
+ },
+ {
+ "action": "org.config.disable_sockpuppet_disallowed",
+ "description": "The interaction limit for existing users only for an organization was disabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
+ "fields": [
+ "_document_id",
+ "operation_type",
+ "actor_id",
+ "org_id",
+ "action",
+ "created_at",
+ "actor",
+ "org",
+ "@timestamp",
+ "user_agent",
+ "request_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
+ },
+ {
+ "action": "org.config.enable_collaborators_only",
+ "description": "The interaction limit for collaborators only for an organization was enabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
+ "fields": [
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "actor_id",
+ "actor",
+ "org",
+ "org_id",
+ "request_id",
+ "operation_type",
+ "action",
+ "user_agent"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
+ },
+ {
+ "action": "org.config.enable_contributors_only",
+ "description": "The interaction limit for prior contributors only for an organization was enabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "org",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
+ },
+ {
+ "action": "org.config.enable_sockpuppet_disallowed",
+ "description": "The interaction limit for existing users only for an organization was enabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
+ "fields": [
+ "actor_id",
+ "request_id",
+ "action",
+ "created_at",
+ "user_agent",
+ "actor",
+ "_document_id",
+ "org_id",
+ "operation_type",
+ "org",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
+ },
+ {
+ "action": "org.configure_self_hosted_jit_runner",
+ "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
+ "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
+ },
+ {
+ "action": "org.confirm_business_invitation",
+ "description": "An invitation for an organization to join an enterprise was confirmed.",
+ "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Adding organizations to your enterprise"
+ },
+ {
+ "action": "org.create",
+ "description": "An organization was created.",
+ "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
+ "fields": [
+ "request_id",
+ "org",
+ "actor_id",
+ "actor",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "operation_type",
+ "org_id",
+ "created_at",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
+ },
+ {
+ "action": "org.delete",
+ "description": "An organization was deleted by a user or staff.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "@timestamp",
+ "_document_id",
+ "created_at",
+ "actor",
+ "org_id",
+ "org",
+ "action",
+ "actor_id",
+ "operation_type",
+ "request_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.disable_member_team_creation_permission",
+ "description": "Team creation was limited to owners.",
+ "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
+ "fields": [
+ "actor",
+ "@timestamp",
+ "_document_id",
+ "user",
+ "user_id",
+ "action",
+ "created_at",
+ "actor_id",
+ "user_agent",
+ "org",
+ "org_id",
+ "operation_type",
+ "request_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
+ },
+ {
+ "action": "org.disable_reader_discussion_creation_permission",
+ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
+ },
+ {
+ "action": "org.disable_saml",
+ "description": "SAML single sign-on was disabled for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "sso_url",
+ "issuer",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "created_at",
+ "org",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.disable_two_factor_requirement",
+ "description": "A two-factor authentication requirement was disabled for the organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "org",
+ "org_id",
+ "action",
+ "actor",
+ "actor_id",
+ "operation_type",
+ "request_id",
+ "@timestamp",
+ "_document_id",
+ "user_agent"
+ ]
+ },
+ {
+ "action": "org.display_commenter_full_name_disabled",
+ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "user_id",
+ "user",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "created_at",
+ "user_agent",
+ "org",
+ "actor_id",
+ "org_id",
+ "request_id"
+ ]
+ },
+ {
+ "action": "org.display_commenter_full_name_enabled",
+ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "user_agent",
+ "request_id",
+ "actor",
+ "_document_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "user",
+ "action",
+ "actor_id",
+ "org_id"
+ ]
+ },
+ {
+ "action": "org.enable_member_team_creation_permission",
+ "description": "Team creation by members was allowed.",
+ "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
+ "fields": [
+ "org_id",
+ "user",
+ "actor",
+ "operation_type",
+ "_document_id",
+ "user_id",
+ "created_at",
+ "user_agent",
+ "actor_id",
+ "org",
+ "request_id",
+ "action",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
+ },
+ {
+ "action": "org.enable_reader_discussion_creation_permission",
+ "description": "An organization owner allowed users with read access to create discussions in an organization",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
+ },
+ {
+ "action": "org.enable_saml",
+ "description": "SAML single sign-on was enabled for the organization.",
+ "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
+ "fields": [
+ "actor_id",
+ "action",
+ "operation_type",
+ "actor",
+ "sso_url",
+ "org",
+ "created_at",
+ "@timestamp",
+ "issuer",
+ "org_id",
+ "_document_id",
+ "user_agent",
+ "request_id"
+ ],
+ "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
+ },
+ {
+ "action": "org.enable_two_factor_requirement",
+ "description": "Two-factor authentication is now required for the organization.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
+ "fields": [
+ "actor_id",
+ "action",
+ "_document_id",
+ "org",
+ "@timestamp",
+ "actor",
+ "user_agent",
+ "org_id",
+ "operation_type",
+ "created_at",
+ "request_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
+ },
+ {
+ "action": "org.integration_manager_added",
+ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "org_id",
+ "manager",
+ "@timestamp",
+ "request_id",
+ "actor",
+ "operation_type",
+ "_document_id",
+ "actor_id",
+ "org",
+ "action",
+ "created_at"
+ ]
+ },
+ {
+ "action": "org.integration_manager_removed",
+ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "@timestamp",
+ "org",
+ "user_agent",
+ "request_id",
+ "action",
+ "actor",
+ "actor_id",
+ "manager",
+ "operation_type",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "org.invite_member",
+ "description": "A new user was invited to join an organization.",
+ "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
+ "fields": [
+ "org",
+ "user_id",
+ "invitation_id",
+ "org_id",
+ "user",
+ "action",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "actor_id",
+ "request_id",
+ "invitee_email",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
+ },
+ {
+ "action": "org.invite_to_business",
+ "description": "An organization was invited to join an enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.members_can_update_protected_branches.disable",
+ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "org.members_can_update_protected_branches.enable",
+ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "org_id",
+ "user_agent",
+ "actor_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "request_id",
+ "_document_id",
+ "actor",
+ "user",
+ "action"
+ ]
+ },
+ {
+ "action": "org.rate_limited_invites",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "created_at",
+ "request_id",
+ "org_id",
+ "action",
+ "actor",
+ "actor_id",
+ "user_agent",
+ "operation_type",
+ "_document_id",
+ "org"
+ ]
+ },
+ {
+ "action": "org.recreate",
+ "description": "An organization was restored.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "org",
+ "action",
+ "operation_type",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "@timestamp",
+ "request_id",
+ "actor",
+ "org_id"
+ ]
+ },
+ {
+ "action": "org.register_self_hosted_runner",
+ "description": "A new self-hosted runner was registered.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
+ "fields": [
+ "actor",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "created_at",
+ "user_agent",
+ "actor_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Adding self-hosted runners"
+ },
+ {
+ "action": "org.remove_billing_manager",
+ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
+ "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
+ "fields": [
+ "user_id",
+ "user_agent",
+ "org_id",
+ "user",
+ "action",
+ "_document_id",
+ "operation_type",
+ "@timestamp",
+ "actor",
+ "org",
+ "actor_id",
+ "request_id",
+ "created_at"
+ ],
+ "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
+ },
+ {
+ "action": "org.remove_member",
+ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "request_id",
+ "actor_id",
+ "user_agent",
+ "actor",
+ "action",
+ "user_id",
+ "@timestamp",
+ "created_at",
+ "user",
+ "operation_type",
+ "org_id",
+ "org",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "org.remove_outside_collaborator",
+ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "user",
+ "org_id",
+ "created_at",
+ "request_id",
+ "@timestamp",
+ "action",
+ "operation_type",
+ "user_agent",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "user_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.remove_security_manager",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org_id",
+ "org",
+ "team",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "org.remove_self_hosted_runner",
+ "description": "A self-hosted runner was removed.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
+ "fields": [
+ "operation_type",
+ "org_id",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "org",
+ "created_at",
+ "actor",
+ "action",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Removing self-hosted runners"
+ },
+ {
+ "action": "org.rename",
+ "description": "An organization was renamed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "_document_id",
+ "@timestamp",
+ "org",
+ "action",
+ "actor",
+ "old_login",
+ "org_id",
+ "request_id",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.restore_member",
+ "description": "An organization member was restored.",
+ "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
+ "fields": [
+ "user",
+ "actor",
+ "user_id",
+ "_document_id",
+ "action",
+ "created_at",
+ "org_id",
+ "operation_type",
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "org",
+ "actor_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
+ },
+ {
+ "action": "org.runner_group_created",
+ "description": "A self-hosted runner group was created.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "runner_group_restricted_to_workflows",
+ "runner_group_selected_workflow_refs",
+ "programmatic_access_type",
+ "network_configuration_id"
+ ],
+ "docs_reference_titles": "Managing access to self-hosted runners using groups"
+ },
+ {
+ "action": "org.runner_group_removed",
+ "description": "A self-hosted runner group was removed.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Managing access to self-hosted runners using groups"
+ },
+ {
+ "action": "org.runner_group_runner_removed",
+ "description": "The REST API was used to remove a self-hosted runner from a group.",
+ "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "runner_group_id",
+ "runner_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
+ },
+ {
+ "action": "org.runner_group_runners_added",
+ "description": "A self-hosted runner was added to a group.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing access to self-hosted runners using groups"
+ },
+ {
+ "action": "org.runner_group_runners_updated",
+ "description": "A runner group's list of members was updated.",
+ "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "runner_group_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
+ },
+ {
+ "action": "org.runner_group_updated",
+ "description": "The configuration of a self-hosted runner group was changed.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "runner_group_name",
+ "runner_group_allow_public",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "runner_group_restricted_to_workflows",
+ "runner_group_selected_workflow_refs",
+ "programmatic_access_type",
+ "network_configuration_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing access to self-hosted runners using groups"
+ },
+ {
+ "action": "org_secret_scanning_automatic_validity_checks.disabled",
+ "description": "Automatic partner validation checks have been disabled at the organization level",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
+ },
+ {
+ "action": "org_secret_scanning_automatic_validity_checks.enabled",
+ "description": "Automatic partner validation checks have been enabled at the organization level",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
+ },
+ {
+ "action": "org_secret_scanning_custom_pattern.create",
+ "description": "A custom pattern was created for secret scanning in an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "org_secret_scanning_custom_pattern.delete",
+ "description": "A custom pattern was removed from secret scanning in an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "org_secret_scanning_custom_pattern.publish",
+ "description": "A custom pattern was published for secret scanning in an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "org.secret_scanning_custom_pattern_push_protection_disabled",
+ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "org.secret_scanning_custom_pattern_push_protection_enabled",
+ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "org_secret_scanning_custom_pattern.update",
+ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "org_secret_scanning_non_provider_patterns.disabled",
+ "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
+ "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Supported secret scanning patterns"
+ },
+ {
+ "action": "org_secret_scanning_non_provider_patterns.enabled",
+ "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
+ "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Supported secret scanning patterns"
+ },
+ {
+ "action": "org_secret_scanning_push_protection_bypass_list.add",
+ "description": "A role or team was added to the push protection bypass list at the organization level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org_secret_scanning_push_protection_bypass_list.disable",
+ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org_secret_scanning_push_protection_bypass_list.enable",
+ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org_secret_scanning_push_protection_bypass_list.remove",
+ "description": "A role or team was removed from the push protection bypass list at the organization level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_custom_message_disabled",
+ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_custom_message_enabled",
+ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_custom_message_updated",
+ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_disable",
+ "description": "Push protection for secret scanning was disabled.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_enable",
+ "description": "Push protection for secret scanning was enabled.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_new_repos_disable",
+ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_new_repos_enable",
+ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
+ "description": "The push protection setting was updated for a secret type for your organization.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
+ "fields": [
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "push_protection_setting",
+ "secret_type",
+ "secret_type_display_name",
+ "created_at"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org_secret_scanning_push_protection_pattern_configuration.updated",
+ "description": "The push protection pattern configuration was updated for your organization.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
+ "fields": [
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "created_at"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.security_center_export_code_scanning_metrics",
+ "description": "A CSV export was requested on the CodeQL pull request alerts page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "start_date",
+ "end_date",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "org.security_center_export_coverage",
+ "description": "A CSV export was requested on the Coverage page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.security_center_export_overview_dashboard",
+ "description": "A CSV export was requested on the Overview Dashboard page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "start_date",
+ "end_date",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.security_center_export_risk",
+ "description": "A CSV export was requested on the Risk page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.self_hosted_runner_offline",
+ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
+ "fields": [
+ "org_id",
+ "org",
+ "runner_id",
+ "runner_name",
+ "action",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+ },
+ {
+ "action": "org.self_hosted_runner_online",
+ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
+ "fields": [
+ "org_id",
+ "org",
+ "runner_id",
+ "runner_name",
+ "action",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+ },
+ {
+ "action": "org.self_hosted_runner_updated",
+ "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
+ "fields": [
+ "org_id",
+ "runner_id",
+ "runner_name",
+ "source_version",
+ "target_version",
+ "runner_group_id",
+ "runner_group_name"
+ ],
+ "docs_reference_titles": "Self-hosted runners"
+ },
+ {
+ "action": "org.set_actions_cache_retention_policy",
+ "description": "The cache retention policy for GitHub Actions was set for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization"
+ },
+ {
+ "action": "org.set_actions_cache_storage_policy",
+ "description": "The cache storage policy for GitHub Actions was set for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization"
+ },
+ {
+ "action": "org.set_actions_fork_pr_approvals_policy",
+ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "policy",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
+ },
+ {
+ "action": "org.set_actions_private_fork_pr_approvals_policy",
+ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "policy",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
+ },
+ {
+ "action": "org.set_actions_retention_limit",
+ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
+ "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "limit",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
+ },
+ {
+ "action": "org.set_custom_invitation_rate_limit",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "_document_id",
+ "org_id",
+ "operation_type",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "request_id",
+ "created_at",
+ "org",
+ "action"
+ ]
+ },
+ {
+ "action": "org.set_default_workflow_permissions",
+ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
+ },
+ {
+ "action": "org.set_fork_pr_workflows_policy",
+ "description": "The policy for workflows on private repository forks was changed.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "policy",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
+ },
+ {
+ "action": "org.set_workflow_permission_can_approve_pr",
+ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
+ },
+ {
+ "action": "org.sso_response",
+ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "org_id",
+ "@timestamp",
+ "org",
+ "issuer",
+ "business",
+ "operation_type",
+ "created_at",
+ "request_id",
+ "business_id",
+ "_document_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.transform",
+ "description": "A user account was converted into an organization.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization",
+ "fields": [
+ "actor",
+ "_document_id",
+ "request_id",
+ "operation_type",
+ "actor_id",
+ "org_id",
+ "org",
+ "action",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "owner",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Converting a user into an organization"
+ },
+ {
+ "action": "org.unblock_user",
+ "description": "A user was unblocked from an organization.",
+ "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
+ "fields": [
+ "oauth_application_id",
+ "_document_id",
+ "blocked_user",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "request_id",
+ "created_at",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "user_agent"
+ ],
+ "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
+ },
+ {
+ "action": "org.update_actions_settings",
+ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "new_policy",
+ "updated_allowed_types",
+ "old_policy",
+ "updated_access_policy",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
+ },
+ {
+ "action": "org.update_default_repository_permission",
+ "description": "The default repository permission level for organization members was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "action",
+ "operation_type",
+ "created_at",
+ "org",
+ "org_id",
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "permission",
+ "actor_id",
+ "old_permission",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "org.update_member",
+ "description": "A person's role was changed from owner to member or member to owner.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "org_id",
+ "created_at",
+ "_document_id",
+ "user",
+ "user_id",
+ "action",
+ "request_id",
+ "actor_id",
+ "old_permission",
+ "permission",
+ "actor",
+ "user_agent",
+ "operation_type",
+ "org"
+ ]
+ },
+ {
+ "action": "org.update_member_repository_creation_permission",
+ "description": "The create repository permission for organization members was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "action",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "permission",
+ "created_at",
+ "user_agent",
+ "org",
+ "org_id",
+ "_document_id",
+ "visibility",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.update_member_repository_invitation_permission",
+ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
+ "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
+ "fields": [
+ "actor_id",
+ "permission",
+ "action",
+ "org_id",
+ "actor",
+ "created_at",
+ "_document_id",
+ "business_id",
+ "operation_type",
+ "org",
+ "user_agent",
+ "request_id",
+ "business",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Setting permissions for adding outside collaborators"
+ },
+ {
+ "action": "org.update_saml_provider_settings",
+ "description": "An organization's SAML provider settings were updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "sso_url",
+ "actor_id",
+ "operation_type",
+ "@timestamp",
+ "issuer",
+ "org",
+ "_document_id",
+ "actor",
+ "org_id",
+ "created_at",
+ "request_id",
+ "action"
+ ]
+ },
+ {
+ "action": "org.update_terms_of_service",
+ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
+ "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
+ "fields": [
+ "request_id",
+ "org_id",
+ "actor",
+ "actor_id",
+ "user_agent",
+ "operation_type",
+ "_document_id",
+ "org",
+ "action",
+ "@timestamp",
+ "created_at",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
+ },
+ {
+ "action": "organization_custom_property_definition.create",
+ "description": "A new organization custom property definition was created.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "definition_id",
+ "property_name",
+ "description",
+ "value_type",
+ "required",
+ "allowed_values",
+ "default_value",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
+ },
+ {
+ "action": "organization_custom_property_definition.destroy",
+ "description": "An organization custom property definition was deleted.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "definition_id",
+ "property_name",
+ "description",
+ "value_type",
+ "required",
+ "allowed_values",
+ "default_value",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
+ },
+ {
+ "action": "organization_custom_property_definition.update",
+ "description": "An organization custom property definition was updated.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "definition_id",
+ "property_name",
+ "old_values_editable_by",
+ "values_editable_by",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "old_allowed_values",
+ "old_default_value",
+ "old_required"
+ ],
+ "docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
+ },
+ {
+ "action": "organization_custom_property_value.create",
+ "description": "An organization's custom property value was manually set for the first time.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "definition_id",
+ "property_name",
+ "value",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
+ },
+ {
+ "action": "organization_custom_property_value.destroy",
+ "description": "An organization's custom property value was deleted.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "definition_id",
+ "property_name",
+ "value",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
+ },
+ {
+ "action": "organization_domain.approve",
+ "description": "A domain was approved for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner_type",
+ "domain_name",
+ "org_id",
+ "business_id",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
+ },
+ {
+ "action": "organization_domain.create",
+ "description": "A domain was added to an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
+ "fields": [
+ "created_at",
+ "_document_id",
+ "domain_name",
+ "action",
+ "request_id",
+ "actor_id",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "actor"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
+ },
+ {
+ "action": "organization_domain.destroy",
+ "description": "A domain was removed from an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
+ "fields": [
+ "action",
+ "domain_name",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "operation_type",
+ "created_at"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain"
+ },
+ {
+ "action": "organization_domain.verify",
+ "description": "A domain was verified for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
+ "fields": [
+ "operation_type",
+ "domain_name",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "actor",
+ "action",
+ "created_at",
+ "_document_id",
+ "actor_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
+ },
+ {
+ "action": "packages.package_deleted",
+ "description": "An entire package was deleted.",
+ "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
+ "fields": [
+ "actor_id",
+ "actor",
+ "org",
+ "org_id",
+ "repo",
+ "repo_id",
+ "package",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
+ },
+ {
+ "action": "packages.package_published",
+ "description": "A package was published or republished to an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "actor",
+ "org",
+ "org_id",
+ "repo",
+ "repo_id",
+ "package",
+ "ecosystem",
+ "version_count",
+ "is_republished",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "packages.package_version_deleted",
+ "description": "A specific package version was deleted.",
+ "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
+ "fields": [
+ "actor_id",
+ "actor",
+ "org",
+ "org_id",
+ "repo",
+ "repo_id",
+ "package",
+ "version",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "ecosystem",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
+ },
+ {
+ "action": "packages.package_version_published",
+ "description": "A specific package version was published or republished to a package.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "ecosystem",
+ "package",
+ "version",
+ "actor_id",
+ "user_agent",
+ "is_republished",
+ "actor",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "pages_protected_domain.create",
+ "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
+ "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "owner_type",
+ "domain",
+ "state",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
+ },
+ {
+ "action": "pages_protected_domain.delete",
+ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
+ "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "owner_type",
+ "domain",
+ "state",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
+ },
+ {
+ "action": "pages_protected_domain.verify",
+ "description": "A GitHub Pages domain was verified for an organization or enterprise.",
+ "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "owner_type",
+ "domain",
+ "state",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
+ },
+ {
+ "action": "passkey.register",
+ "description": "A new passkey was added.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "nickname",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "passkey.remove",
+ "description": "A new passkey was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "nickname",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "payment_method.create",
+ "description": "A new payment method was added, such as a new credit card or PayPal account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "user",
+ "operation_type",
+ "user_id",
+ "_document_id",
+ "action",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "payment_method.remove",
+ "description": "A payment method was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "created_at",
+ "actor_id",
+ "@timestamp",
+ "user_id",
+ "action",
+ "operation_type",
+ "actor",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "payment_method.update",
+ "description": "An existing payment method was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "request_id",
+ "org_id",
+ "created_at",
+ "actor_id",
+ "@timestamp",
+ "action",
+ "actor",
+ "org",
+ "user_agent",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.access_granted",
+ "description": "A fine-grained personal access token was granted access to resources.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_id",
+ "user_programmatic_access_name",
+ "repository_selection",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
+ },
+ {
+ "action": "personal_access_token.access_restriction_disabled",
+ "description": "The configured restriction for access to resources via personal access tokens was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "programmatic_access_type",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.access_restriction_enabled",
+ "description": "The configured restriction for access to resources via personal access tokens was enabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "programmatic_access_type",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.access_restriction_reset",
+ "description": "The configured restriction for access to resources via personal access tokens was reset and delegated to organizations.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "programmatic_access_type",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "personal_access_token.access_revoked",
+ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_id",
+ "user_programmatic_access_name",
+ "repository_selection",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
+ },
+ {
+ "action": "personal_access_token.auto_approve_grant_requests_disabled",
+ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "personal_access_token.auto_approve_grant_requests_enabled",
+ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "personal_access_token.auto_approve_grant_requests_reset",
+ "description": "Triggered when the enterprise delegates to the organizations when to require approval for fine-grained personal access tokens before the tokens can access organization resources.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "personal_access_token.create",
+ "description": "Triggered when you create a fine-grained personal access token.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_name",
+ "user",
+ "user_id",
+ "repository_selection",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "personal_access_token.credential_regenerated",
+ "description": "Triggered when you regenerate a fine-grained personal access token.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_name",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.credential_revoked",
+ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
+ "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
+ "fields": [
+ "user_programmatic_access_name",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users"
+ },
+ {
+ "action": "personal_access_token.destroy",
+ "description": "Triggered when you delete a fine-grained personal access token.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_name",
+ "user",
+ "user_id",
+ "explanation",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.expiration_limit_set",
+ "description": "A personal access token expiration limit was set.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "programmatic_access_type",
+ "token_expiration",
+ "old_token_expiration",
+ "exempt_administrators",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.expiration_limit_unset",
+ "description": "A personal access token expiration limit was unset.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "programmatic_access_type",
+ "old_token_expiration",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.request_cancelled",
+ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_name",
+ "org",
+ "org_id",
+ "repository_selection",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "user_programmatic_access_request_id"
+ ]
+ },
+ {
+ "action": "personal_access_token.request_created",
+ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_id",
+ "user_programmatic_access_name",
+ "user",
+ "user_id",
+ "repository_selection",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "user_programmatic_access_request_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
+ },
+ {
+ "action": "personal_access_token.request_denied",
+ "description": "A request for a fine-grained personal access token to access organization resources was denied.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user_programmatic_access_name",
+ "org",
+ "org_id",
+ "repository_selection",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "user_programmatic_access_request_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
+ },
+ {
+ "action": "personal_access_token.update",
+ "description": "A fine-grained personal access token was updated.",
+ "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_name",
+ "user",
+ "user_id",
+ "repository_selection",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens"
+ },
+ {
+ "action": "premium_runner.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "runner_group_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "premium_runner.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "premium_runner.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "runner_group_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "private_vulnerability_reporting.disable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "private_vulnerability_reporting.enable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "private_vulnerability_reporting_new_repos.disable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "private_vulnerability_reporting_new_repos.enable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "profile_picture.update",
+ "description": "A profile picture was updated.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
+ "fields": [
+ "user",
+ "actor_id",
+ "user_id",
+ "@timestamp",
+ "created_at",
+ "owner",
+ "action",
+ "_document_id",
+ "request_id",
+ "user_agent",
+ "actor",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Personalize your profile"
+ },
+ {
+ "action": "project.access",
+ "description": "A project board visibility was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "actor",
+ "user_agent",
+ "operation_type",
+ "user",
+ "created_at",
+ "user_id",
+ "action",
+ "request_id",
+ "_document_id",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "project.close",
+ "description": "A project board was closed.",
+ "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
+ "fields": [
+ "org_id",
+ "user_agent",
+ "request_id",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "repo_id",
+ "org",
+ "_document_id",
+ "project_id",
+ "action",
+ "actor",
+ "actor_id",
+ "repo",
+ "project_kind"
+ ],
+ "docs_reference_titles": "Closing a project (classic)"
+ },
+ {
+ "action": "project_collaborator.add",
+ "description": "A collaborator was added to a project.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "collaborator_type",
+ "org",
+ "org_id",
+ "collaborator",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "public_project",
+ "project_name",
+ "project_role",
+ "old_project_role",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "project_collaborator.remove",
+ "description": "A collaborator was removed from a project.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "collaborator_type",
+ "user",
+ "user_id",
+ "collaborator",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "project_collaborator.update",
+ "description": "A project collaborator's permission level was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "public_project",
+ "project_name",
+ "collaborator_type",
+ "project_role",
+ "old_project_role",
+ "project_id",
+ "user",
+ "user_id",
+ "collaborator",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "project.create",
+ "description": "A project board was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "user",
+ "_document_id",
+ "request_id",
+ "user_id",
+ "user_agent",
+ "@timestamp",
+ "actor_id",
+ "action",
+ "created_at",
+ "actor"
+ ]
+ },
+ {
+ "action": "project.delete",
+ "description": "A project board was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "action",
+ "actor_id",
+ "operation_type",
+ "actor",
+ "user_id",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "user"
+ ]
+ },
+ {
+ "action": "project_field.create",
+ "description": "A field was created in a project board.",
+ "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
+ },
+ {
+ "action": "project_field.delete",
+ "description": "A field was deleted in a project board.",
+ "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
+ },
+ {
+ "action": "project.link",
+ "description": "A repository was linked to a project board.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo_id",
+ "action",
+ "actor_id",
+ "org_id",
+ "user_agent",
+ "request_id",
+ "actor",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "created_at",
+ "org",
+ "repo"
+ ]
+ },
+ {
+ "action": "project.open",
+ "description": "A project board was reopened.",
+ "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
+ "fields": [
+ "actor",
+ "request_id",
+ "actor_id",
+ "action",
+ "user_id",
+ "project_id",
+ "_document_id",
+ "user_agent",
+ "operation_type",
+ "user",
+ "@timestamp",
+ "created_at",
+ "project_kind",
+ "project_name"
+ ],
+ "docs_reference_titles": "Reopening a closed project (classic)"
+ },
+ {
+ "action": "project.rename",
+ "description": "A project board was renamed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "created_at",
+ "request_id",
+ "actor_id",
+ "old_name",
+ "operation_type",
+ "@timestamp",
+ "repo",
+ "_document_id",
+ "user_agent",
+ "org_id",
+ "business_id",
+ "actor",
+ "repo_id",
+ "org",
+ "business"
+ ]
+ },
+ {
+ "action": "project.unlink",
+ "description": "A repository was unlinked from a project board.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "repo_id",
+ "operation_type",
+ "actor",
+ "action",
+ "created_at",
+ "actor_id",
+ "_document_id",
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "org",
+ "org_id"
+ ]
+ },
+ {
+ "action": "project.update_org_permission",
+ "description": "The project's base-level permission for all organization members was changed or removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "org",
+ "@timestamp",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "request_id",
+ "actor_id",
+ "action",
+ "org_id",
+ "user_agent"
+ ]
+ },
+ {
+ "action": "project.update_team_permission",
+ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "org_id",
+ "operation_type",
+ "org",
+ "actor_id",
+ "_document_id",
+ "request_id",
+ "team",
+ "@timestamp",
+ "action",
+ "user_agent",
+ "actor"
+ ]
+ },
+ {
+ "action": "project.update_user_permission",
+ "description": "A user was added to or removed from a project board or had their permission level changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "actor_id",
+ "user",
+ "user_agent",
+ "actor",
+ "created_at",
+ "org",
+ "_document_id",
+ "org_id",
+ "action",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "project_view.create",
+ "description": "A view was created in a project board.",
+ "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
+ },
+ {
+ "action": "project_view.delete",
+ "description": "A view was deleted in a project board.",
+ "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
+ },
+ {
+ "action": "project.visibility_private",
+ "description": "A project's visibility was changed from public to private.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "project_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "project_kind",
+ "project_name"
+ ]
+ },
+ {
+ "action": "project.visibility_public",
+ "description": "A project's visibility was changed from private to public.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "project_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "project_kind",
+ "project_name",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "protected_branch.authorized_users_teams",
+ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
+ "fields": [
+ "repo",
+ "action",
+ "org_id",
+ "user_agent",
+ "name",
+ "created_at",
+ "_document_id",
+ "operation_type",
+ "actor",
+ "repo_id",
+ "org",
+ "request_id",
+ "actor_id",
+ "oauth_application_id",
+ "@timestamp",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
+ },
+ {
+ "action": "protected_branch.branch_allowances",
+ "description": "A protected branch allowance was given to a specific user, team or integration.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "token_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "name",
+ "authorized_actors",
+ "policy",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "protected_branch.create",
+ "description": "Branch protection was enabled on a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "repo_id",
+ "user_id",
+ "@timestamp",
+ "user_agent",
+ "repo",
+ "name",
+ "org_id",
+ "user",
+ "_document_id",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "action",
+ "created_at",
+ "authorized_actor_names",
+ "token_scopes",
+ "required_deployments_enforcement_level",
+ "merge_queue_enforcement_level",
+ "create_protected"
+ ]
+ },
+ {
+ "action": "protected_branch.destroy",
+ "description": "Branch protection was disabled on a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "name",
+ "repo",
+ "@timestamp",
+ "actor",
+ "org",
+ "actor_id",
+ "request_id",
+ "repo_id",
+ "org_id",
+ "operation_type",
+ "action",
+ "user_agent",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "required_deployments_enforcement_level",
+ "merge_queue_enforcement_level",
+ "create_protected"
+ ]
+ },
+ {
+ "action": "protected_branch.dismiss_stale_reviews",
+ "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "dismiss_stale_reviews_on_push",
+ "org_id",
+ "action",
+ "created_at",
+ "request_id",
+ "_document_id",
+ "@timestamp",
+ "actor_id",
+ "repo_id",
+ "operation_type",
+ "actor",
+ "repo",
+ "org",
+ "name",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.dismissal_restricted_users_teams",
+ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "repo_id",
+ "actor",
+ "oauth_application_id",
+ "authorized_actors_only",
+ "authorized_actors",
+ "created_at",
+ "user_agent",
+ "name",
+ "_document_id",
+ "org_id",
+ "request_id",
+ "@timestamp",
+ "actor_id",
+ "org",
+ "action",
+ "operation_type",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.policy_override",
+ "description": "A branch protection requirement was overridden by a repository administrator.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo_id",
+ "created_at",
+ "actor",
+ "reasons",
+ "@timestamp",
+ "before",
+ "after",
+ "actor_id",
+ "repo",
+ "operation_type",
+ "user_agent",
+ "branch",
+ "overridden_codes",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "request_id",
+ "referrer",
+ "business",
+ "business_id",
+ "deploy_key_fingerprint",
+ "token_scopes",
+ "programmatic_access_type",
+ "compliant_pull_request_ids",
+ "rule_suite_id"
+ ]
+ },
+ {
+ "action": "protected_branch.rejected_ref_update",
+ "description": "A branch update attempt was rejected.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "org",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "org_id",
+ "operation_type",
+ "request_id",
+ "repo_id",
+ "actor",
+ "branch",
+ "before",
+ "overridden_codes",
+ "after",
+ "action",
+ "reasons",
+ "actor_id",
+ "business_id",
+ "deploy_key_fingerprint",
+ "token_scopes",
+ "programmatic_access_type",
+ "compliant_pull_request_ids",
+ "actor_is_bot",
+ "rule_suite_id"
+ ]
+ },
+ {
+ "action": "protected_branch.update_admin_enforced",
+ "description": "Branch protection was enforced for repository administrators.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "admin_enforced",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "org",
+ "name",
+ "repo",
+ "@timestamp",
+ "action",
+ "repo_id",
+ "org_id",
+ "_document_id",
+ "created_at",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_allow_deletions_enforcement_level",
+ "description": "Branch deletion was enabled or disabled for a protected branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "name",
+ "operation_type",
+ "request_id",
+ "repo",
+ "@timestamp",
+ "org_id",
+ "org",
+ "action",
+ "allow_deletions_enforcement_level",
+ "_document_id",
+ "created_at",
+ "actor_id",
+ "user_agent",
+ "actor",
+ "repo_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "protected_branch.update_allow_force_pushes_enforcement_level",
+ "description": "Force pushes were enabled or disabled for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "actor_id",
+ "name",
+ "_document_id",
+ "actor",
+ "repo",
+ "operation_type",
+ "request_id",
+ "allow_force_pushes_enforcement_level",
+ "@timestamp",
+ "org",
+ "action",
+ "created_at",
+ "user_agent",
+ "repo_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_ignore_approvals_from_contributors",
+ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "ignore_approvals_from_contributors",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+ },
+ {
+ "action": "protected_branch.update_linear_history_requirement_enforcement_level",
+ "description": "Required linear commit history was enabled or disabled for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "user_agent",
+ "operation_type",
+ "actor",
+ "linear_history_requirement_enforcement_level",
+ "repo",
+ "request_id",
+ "name",
+ "org_id",
+ "repo_id",
+ "org",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_lock_allows_fetch_and_merge",
+ "description": "Fork syncing was enabled or disabled for a read-only branch",
+ "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "lock_allows_fetch_and_merge",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
+ },
+ {
+ "action": "protected_branch.update_lock_branch_enforcement_level",
+ "description": "The enforcement of a branch lock was updated.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "enforcement_level",
+ "lock_branch_enforcement_level",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
+ },
+ {
+ "action": "protected_branch.update_merge_queue_enforcement_level",
+ "description": "Enforcement of the merge queue was modified for a branch.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "merge_queue_enforcement_level",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
+ },
+ {
+ "action": "protected_branch.update_name",
+ "description": "A branch name pattern was updated for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "old_name",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "protected_branch.update_pull_request_reviews_enforcement_level",
+ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "name",
+ "org_id",
+ "_document_id",
+ "actor_id",
+ "@timestamp",
+ "business_id",
+ "request_id",
+ "pull_request_reviews_enforcement_level",
+ "org",
+ "repo",
+ "action",
+ "business",
+ "user_agent",
+ "created_at",
+ "repo_id",
+ "operation_type",
+ "actor",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_require_code_owner_review",
+ "description": "Enforcement of required code owner review was updated for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "created_at",
+ "require_code_owner_review",
+ "operation_type",
+ "name",
+ "user_agent",
+ "action",
+ "@timestamp",
+ "actor",
+ "actor_id",
+ "repo",
+ "request_id",
+ "org",
+ "repo_id",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_require_last_push_approval",
+ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "require_last_push_approval",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
+ },
+ {
+ "action": "protected_branch.update_required_approving_review_count",
+ "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "required_approving_review_count",
+ "repo",
+ "request_id",
+ "repo_id",
+ "created_at",
+ "actor",
+ "operation_type",
+ "user_agent",
+ "name",
+ "org_id",
+ "action",
+ "actor_id",
+ "_document_id",
+ "org",
+ "@timestamp",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_required_status_checks_enforcement_level",
+ "description": "Enforcement of required status checks was updated for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "org_id",
+ "user_agent",
+ "@timestamp",
+ "_document_id",
+ "name",
+ "repo",
+ "action",
+ "business_id",
+ "repo_id",
+ "business",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "request_id",
+ "required_status_checks_enforcement_level",
+ "org",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_signature_requirement_enforcement_level",
+ "description": "Enforcement of required commit signing was updated for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "name",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "actor",
+ "actor_id",
+ "signature_requirement_enforcement_level",
+ "repo",
+ "user_agent",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_strict_required_status_checks_policy",
+ "description": "Enforcement of required status checks was updated for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "_document_id",
+ "org",
+ "@timestamp",
+ "created_at",
+ "repo_id",
+ "org_id",
+ "user_agent",
+ "name",
+ "actor",
+ "repo",
+ "operation_type",
+ "action",
+ "strict_required_status_checks_policy",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "public_key.create",
+ "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
+ "fields": [
+ "read_only",
+ "user_agent",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "_document_id",
+ "key",
+ "fingerprint",
+ "actor",
+ "action",
+ "user",
+ "user_id",
+ "@timestamp",
+ "request_id",
+ "title",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
+ },
+ {
+ "action": "public_key.delete",
+ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
+ "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
+ "fields": [
+ "fingerprint",
+ "user_agent",
+ "read_only",
+ "explanation",
+ "repo",
+ "@timestamp",
+ "action",
+ "key",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "title",
+ "request_id",
+ "actor_id",
+ "repo_id",
+ "created_at",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
+ },
+ {
+ "action": "public_key.unverification_failure",
+ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "title",
+ "key",
+ "fingerprint",
+ "read_only",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "public_key.unverify",
+ "description": "A user account's SSH key or a repository's deploy key was unverified.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "created_at",
+ "operation_type",
+ "_document_id",
+ "title",
+ "request_id",
+ "key",
+ "action",
+ "actor",
+ "read_only",
+ "explanation",
+ "repo_id",
+ "@timestamp",
+ "actor_id",
+ "repo",
+ "user_agent",
+ "fingerprint"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "public_key.update",
+ "description": "A user account's SSH key or a repository's deploy key was updated.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "actor",
+ "user_agent",
+ "key",
+ "fingerprint",
+ "read_only",
+ "repo_id",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "repo",
+ "action",
+ "_document_id",
+ "request_id",
+ "title",
+ "@timestamp",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "public_key.verification_failure",
+ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "repo_id",
+ "actor",
+ "key",
+ "fingerprint",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "oauth_application_id",
+ "title",
+ "action",
+ "user_agent",
+ "created_at",
+ "repo",
+ "read_only",
+ "operation_type",
+ "_document_id",
+ "user",
+ "user_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "public_key.verify",
+ "description": "A user account's SSH key or a repository's deploy key was verified.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "operation_type",
+ "user",
+ "@timestamp",
+ "_document_id",
+ "action",
+ "created_at",
+ "key",
+ "fingerprint",
+ "actor_id",
+ "actor",
+ "title",
+ "user_agent",
+ "user_id",
+ "request_id",
+ "read_only",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "pull_request.close",
+ "description": "A pull request was closed without being merged.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
+ },
+ {
+ "action": "pull_request.converted_to_draft",
+ "description": "A pull request was converted to a draft.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
+ },
+ {
+ "action": "pull_request.create",
+ "description": "A pull request was created.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request"
+ },
+ {
+ "action": "pull_request.create_review_request",
+ "description": "A review was requested on a pull request.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "org_id",
+ "reviewer_type",
+ "reviewer",
+ "reviewer_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
+ },
+ {
+ "action": "pull_request.in_progress",
+ "description": "A pull request was marked as in progress.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "pull_request.indirect_merge",
+ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "pull_request.merge",
+ "description": "A pull request was merged.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
+ },
+ {
+ "action": "pull_request.ready_for_review",
+ "description": "A pull request was marked as ready for review.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
+ },
+ {
+ "action": "pull_request.rebase",
+ "description": "A pull request was rebased.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "pull_request_url",
+ "pull_request_title",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "pull_request.remove_review_request",
+ "description": "A review request was removed from a pull request.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "org_id",
+ "reviewer_type",
+ "reviewer",
+ "reviewer_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
+ },
+ {
+ "action": "pull_request.reopen",
+ "description": "A pull request was reopened after previously being closed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "pull_request_review_comment.create",
+ "description": "A review comment was added to a pull request.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "comment_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
+ },
+ {
+ "action": "pull_request_review_comment.delete",
+ "description": "A review comment on a pull request was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "actor",
+ "@timestamp",
+ "_document_id",
+ "repo",
+ "created_at",
+ "request_id",
+ "comment_id",
+ "actor_id",
+ "repo_id",
+ "action",
+ "operation_type",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "pull_request_review_comment.update",
+ "description": "A review comment on a pull request was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "action",
+ "created_at",
+ "actor",
+ "_document_id",
+ "@timestamp",
+ "comment_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "pull_request_review.delete",
+ "description": "A review on a pull request was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "review_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "pull_request_review.dismiss",
+ "description": "A review on a pull request was dismissed.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "review_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
+ },
+ {
+ "action": "pull_request_review.submit",
+ "description": "A review on a pull request was submitted.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "review_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
+ },
+ {
+ "action": "repo.access",
+ "description": "The visibility of a repository changed.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
+ "fields": [
+ "repo_id",
+ "user",
+ "request_id",
+ "operation_type",
+ "@timestamp",
+ "actor_id",
+ "user_id",
+ "created_at",
+ "user_agent",
+ "actor",
+ "action",
+ "repo",
+ "visibility",
+ "_document_id",
+ "previous_visibility",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
+ },
+ {
+ "action": "repo.actions_enabled",
+ "description": "GitHub Actions was enabled for a repository.",
+ "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
+ },
+ {
+ "action": "repo.add_member",
+ "description": "A collaborator was added to a repository.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
+ "fields": [
+ "visibility",
+ "repo",
+ "created_at",
+ "user_agent",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "repo_id",
+ "user",
+ "request_id",
+ "action",
+ "user_id",
+ "oauth_application_id",
+ "org",
+ "org_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Inviting collaborators to a personal repository"
+ },
+ {
+ "action": "repo.add_topic",
+ "description": "A topic was added to a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
+ "fields": [
+ "action",
+ "user_agent",
+ "actor",
+ "repo",
+ "repo_id",
+ "user",
+ "org",
+ "org_id",
+ "request_id",
+ "actor_id",
+ "topic",
+ "@timestamp",
+ "_document_id",
+ "user_id",
+ "created_at",
+ "operation_type",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
+ },
+ {
+ "action": "repo.advanced_security_disabled",
+ "description": "GitHub Advanced Security was disabled for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "repository",
+ "repository_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
+ },
+ {
+ "action": "repo.advanced_security_enabled",
+ "description": "GitHub Advanced Security was enabled for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "repository",
+ "repository_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
+ },
+ {
+ "action": "repo.archived",
+ "description": "A repository was archived.",
+ "docs_reference_links": "/repositories/archiving-a-github-repository",
+ "fields": [
+ "repo_id",
+ "user_agent",
+ "user_id",
+ "created_at",
+ "@timestamp",
+ "repo",
+ "user",
+ "operation_type",
+ "visibility",
+ "action",
+ "actor_id",
+ "actor",
+ "_document_id",
+ "request_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/archiving-a-github-repository"
+ },
+ {
+ "action": "repo.change_merge_setting",
+ "description": "Pull request merge options were changed for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "oauth_application_id",
+ "user_agent",
+ "request_id",
+ "created_at",
+ "@timestamp",
+ "_document_id",
+ "actor_id",
+ "operation_type",
+ "action",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repo.code_scanning_analysis_deleted",
+ "description": "Code scanning analysis for a repository was deleted.",
+ "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "tool",
+ "category",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
+ },
+ {
+ "action": "repo.code_scanning_autofix_disabled",
+ "description": "Autofix for code scanning alerts was disabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.code_scanning_autofix_enabled",
+ "description": "Autofix for code scanning alerts was enabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.code_scanning_autofix_third_party_tools_disabled",
+ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.code_scanning_autofix_third_party_tools_enabled",
+ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.code_scanning_configuration_for_branch_deleted",
+ "description": "A code scanning configuration for a branch of a repository was deleted.",
+ "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "tool",
+ "branch",
+ "category",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Resolving code scanning alerts"
+ },
+ {
+ "action": "repo.code_scanning_delegated_alert_dismissal_disabled",
+ "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "repo.code_scanning_delegated_alert_dismissal_enabled",
+ "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "repo.codeql_disabled",
+ "description": "Code scanning using the default setup was disabled for a repository.",
+ "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Configuring default setup for code scanning"
+ },
+ {
+ "action": "repo.codeql_enabled",
+ "description": "Code scanning using the default setup was enabled for a repository.",
+ "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "query_suite",
+ "threat_model",
+ "languages",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Configuring default setup for code scanning"
+ },
+ {
+ "action": "repo.codeql_updated",
+ "description": "Code scanning using the default setup was updated for a repository.",
+ "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "query_suite",
+ "threat_model",
+ "languages",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Configuring default setup for code scanning"
+ },
+ {
+ "action": "repo.collaborators_only",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "visibility",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "repo.config.disable_collaborators_only",
+ "description": "The interaction limit for collaborators only was disabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "user_agent",
+ "actor",
+ "actor_id",
+ "repo_id",
+ "_document_id",
+ "action",
+ "created_at",
+ "repo",
+ "operation_type",
+ "@timestamp",
+ "request_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.disable_contributors_only",
+ "description": "The interaction limit for prior contributors only was disabled in a repository.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "repo",
+ "@timestamp",
+ "request_id",
+ "actor",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "repo_id",
+ "action",
+ "operation_type",
+ "created_at"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.disable_sockpuppet_disallowed",
+ "description": "The interaction limit for existing users only was disabled in a repository.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "actor",
+ "request_id",
+ "repo_id",
+ "action",
+ "user_agent",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "actor_id",
+ "repo",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.enable_collaborators_only",
+ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "actor",
+ "oauth_application_id",
+ "created_at",
+ "action",
+ "request_id",
+ "repo_id",
+ "repo",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.enable_contributors_only",
+ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "operation_type",
+ "created_at",
+ "actor",
+ "org",
+ "action",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "org_id",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.enable_sockpuppet_disallowed",
+ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "actor",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "request_id",
+ "action",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.configure_self_hosted_jit_runner",
+ "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
+ "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
+ },
+ {
+ "action": "repo.create",
+ "description": "A repository was created.",
+ "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
+ "fields": [
+ "repo",
+ "user_id",
+ "visibility",
+ "repo_id",
+ "user",
+ "request_id",
+ "actor_id",
+ "action",
+ "operation_type",
+ "request_category",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "actor",
+ "user_agent",
+ "org",
+ "oauth_application_id",
+ "org_id",
+ "request_method",
+ "business",
+ "business_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
+ },
+ {
+ "action": "repo.create_actions_secret",
+ "description": "A GitHub Actions secret was created for a repository.",
+ "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Using secrets in GitHub Actions"
+ },
+ {
+ "action": "repo.create_actions_variable",
+ "description": "A GitHub Actions variable was created for a repository.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "repo.create_integration_secret",
+ "description": "A Codespaces or Dependabot secret was created for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "visibility",
+ "integration",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.destroy",
+ "description": "A repository was deleted.",
+ "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
+ "fields": [
+ "repo",
+ "_document_id",
+ "user_agent",
+ "user_id",
+ "actor",
+ "action",
+ "user",
+ "repo_id",
+ "operation_type",
+ "request_category",
+ "actor_id",
+ "visibility",
+ "request_id",
+ "created_at",
+ "@timestamp",
+ "request_method",
+ "oauth_application_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
+ },
+ {
+ "action": "repo.disk_archive",
+ "description": "A repository was archived on disk.",
+ "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories",
+ "fields": [
+ "actor_id",
+ "repo",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "request_id",
+ "_document_id",
+ "repo_id",
+ "actor",
+ "action",
+ "user_agent"
+ ],
+ "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories"
+ },
+ {
+ "action": "repo.download_zip",
+ "description": "A source code archive of a repository was downloaded as a ZIP file.",
+ "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
+ },
+ {
+ "action": "repo.hide_from_discovery",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user_agent",
+ "org",
+ "operation_type",
+ "visibility",
+ "repo_id",
+ "created_at",
+ "actor",
+ "action",
+ "@timestamp",
+ "org_id",
+ "request_id",
+ "repo",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "repo.noindex",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "visibility",
+ "repo_id",
+ "request_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "actor_id",
+ "created_at",
+ "user",
+ "operation_type",
+ "actor",
+ "user_agent",
+ "repo",
+ "user_id",
+ "public_repo"
+ ]
+ },
+ {
+ "action": "repo.override_unlock",
+ "description": "The repository was unlocked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "repo.pages_build",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "@timestamp",
+ "action",
+ "_document_id",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "operation_type",
+ "user_agent",
+ "request_id",
+ "created_at",
+ "visibility",
+ "actor",
+ "user_id"
+ ]
+ },
+ {
+ "action": "repo.pages_cname",
+ "description": "A GitHub Pages custom domain was modified in a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "@timestamp",
+ "visibility",
+ "repo",
+ "repo_id",
+ "user",
+ "request_id",
+ "actor_id",
+ "cname",
+ "user_agent",
+ "user_id",
+ "created_at",
+ "_document_id",
+ "action",
+ "operation_type",
+ "old_cname",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.pages_create",
+ "description": "A GitHub Pages site was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user",
+ "_document_id",
+ "user_id",
+ "visibility",
+ "action",
+ "user_agent",
+ "operation_type",
+ "repo_id",
+ "created_at",
+ "@timestamp",
+ "request_id",
+ "actor",
+ "repo",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.pages_destroy",
+ "description": "A GitHub Pages site was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "user_id",
+ "action",
+ "request_id",
+ "user",
+ "repo",
+ "user_agent",
+ "_document_id",
+ "actor_id",
+ "@timestamp",
+ "actor",
+ "visibility",
+ "operation_type",
+ "repo_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.pages_https_redirect_disabled",
+ "description": "HTTPS redirects were disabled for a GitHub Pages site.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "actor_id",
+ "repo_id",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "visibility",
+ "user_id",
+ "request_id",
+ "repo",
+ "@timestamp",
+ "operation_type",
+ "action",
+ "created_at",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_https_redirect_enabled",
+ "description": "HTTPS redirects were enabled for a GitHub Pages site.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "user_id",
+ "created_at",
+ "visibility",
+ "actor",
+ "actor_id",
+ "user",
+ "operation_type",
+ "repo_id",
+ "action",
+ "repo",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_private",
+ "description": "A GitHub Pages site visibility was changed to private.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "repo.pages_public",
+ "description": "A GitHub Pages site visibility was changed to public.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_soft_delete",
+ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_soft_delete_restore",
+ "description": "A GitHub Pages site that was previously soft-deleted was restored.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_source",
+ "description": "A GitHub Pages source was modified.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "actor_id",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "@timestamp",
+ "repo_id",
+ "user",
+ "_document_id",
+ "request_id",
+ "visibility",
+ "repo",
+ "created_at",
+ "action",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.register_self_hosted_runner",
+ "description": "A new self-hosted runner was registered.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
+ "fields": [
+ "actor_id",
+ "repo",
+ "operation_type",
+ "action",
+ "@timestamp",
+ "actor",
+ "user_agent",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "repo_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Adding self-hosted runners"
+ },
+ {
+ "action": "repo.remove_actions_secret",
+ "description": "A GitHub Actions secret was deleted for a repository.",
+ "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Using secrets in GitHub Actions"
+ },
+ {
+ "action": "repo.remove_actions_variable",
+ "description": "A GitHub Actions variable was deleted for a repository.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "repo.remove_integration_secret",
+ "description": "A Codespaces or Dependabot secret was deleted for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "integration",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.remove_member",
+ "description": "A collaborator was removed from a repository.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
+ "fields": [
+ "request_id",
+ "user",
+ "business",
+ "action",
+ "actor_id",
+ "org",
+ "org_id",
+ "actor",
+ "created_at",
+ "repo_id",
+ "user_agent",
+ "business_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "visibility",
+ "repo",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Removing a collaborator from a personal repository"
+ },
+ {
+ "action": "repo.remove_self_hosted_runner",
+ "description": "A self-hosted runner was removed.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "repo_id",
+ "@timestamp",
+ "_document_id",
+ "repo",
+ "org_id",
+ "action",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "created_at",
+ "org",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Removing self-hosted runners"
+ },
+ {
+ "action": "repo.remove_topic",
+ "description": "A topic was removed from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "action",
+ "repo_id",
+ "user_agent",
+ "topic",
+ "operation_type",
+ "user_id",
+ "org",
+ "org_id",
+ "actor",
+ "business",
+ "request_id",
+ "repo",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "actor_id",
+ "business_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.rename",
+ "description": "A repository was renamed.",
+ "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
+ "fields": [
+ "user_agent",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "actor",
+ "old_name",
+ "repo",
+ "user_id",
+ "created_at",
+ "user",
+ "action",
+ "operation_type",
+ "visibility",
+ "repo_id",
+ "_document_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
+ },
+ {
+ "action": "repo.require_login",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "visibility",
+ "operation_type",
+ "repo",
+ "_document_id",
+ "user",
+ "user_id",
+ "actor",
+ "actor_id",
+ "user_agent",
+ "repo_id",
+ "action",
+ "@timestamp",
+ "request_id"
+ ]
+ },
+ {
+ "action": "repo.restore",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "action",
+ "_document_id",
+ "actor_id",
+ "user",
+ "operation_type",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "@timestamp",
+ "created_at",
+ "actor",
+ "user_id"
+ ]
+ },
+ {
+ "action": "repo.self_hosted_runner_offline",
+ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
+ "fields": [
+ "repo_id",
+ "repo",
+ "org_id",
+ "org",
+ "runner_id",
+ "runner_name",
+ "action",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+ },
+ {
+ "action": "repo.self_hosted_runner_online",
+ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
+ "fields": [
+ "repo_id",
+ "repo",
+ "org_id",
+ "org",
+ "runner_id",
+ "runner_name",
+ "action",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+ },
+ {
+ "action": "repo.self_hosted_runner_updated",
+ "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
+ "fields": [
+ "repo_id",
+ "runner_id",
+ "runner_name",
+ "source_version",
+ "target_version",
+ "runner_group_id",
+ "runner_group_name"
+ ],
+ "docs_reference_titles": "Self-hosted runners"
+ },
+ {
+ "action": "repo.set_actions_cache_retention_policy",
+ "description": "The cache retention policy for GitHub Actions was set for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
+ },
+ {
+ "action": "repo.set_actions_cache_storage_policy",
+ "description": "The cache storage policy for GitHub Actions was set for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
+ },
+ {
+ "action": "repo.set_actions_fork_pr_approvals_policy",
+ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "policy",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
+ },
+ {
+ "action": "repo.set_actions_private_fork_pr_approvals_policy",
+ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "visibility",
+ "policy",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
+ },
+ {
+ "action": "repo.set_actions_retention_limit",
+ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "limit",
+ "repo",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
+ },
+ {
+ "action": "repo.set_default_workflow_permissions",
+ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
+ },
+ {
+ "action": "repo.set_fork_pr_workflows_policy",
+ "description": "Triggered when the policy for workflows on private repository forks is changed.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "policy",
+ "repo",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
+ },
+ {
+ "action": "repo.set_workflow_permission_can_approve_pr",
+ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
+ },
+ {
+ "action": "repo.staff_unlock",
+ "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "created_at",
+ "actor",
+ "repo_id",
+ "action",
+ "org",
+ "org_id",
+ "request_id",
+ "repo",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "repo.temporary_access_granted",
+ "description": "Temporary access was enabled for a repository.",
+ "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
+ },
+ {
+ "action": "repo.transfer",
+ "description": "A user accepted a request to receive a transferred repository.",
+ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
+ "fields": [
+ "@timestamp",
+ "user_id",
+ "_document_id",
+ "request_id",
+ "actor_id",
+ "repo_id",
+ "owner",
+ "user",
+ "old_user",
+ "action",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "repo",
+ "visibility",
+ "repo_was",
+ "actor"
+ ],
+ "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
+ },
+ {
+ "action": "repo.transfer_outgoing",
+ "description": "A repository was transferred to another repository network.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "new_nwo",
+ "visibility",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.transfer_start",
+ "description": "A user sent a request to transfer a repository to another user or organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "_document_id",
+ "operation_type",
+ "user_id",
+ "request_id",
+ "user",
+ "action",
+ "user_agent",
+ "created_at",
+ "actor",
+ "visibility",
+ "repo_id",
+ "actor_id",
+ "repo",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.unarchived",
+ "description": "A repository was unarchived.",
+ "docs_reference_links": "/repositories/archiving-a-github-repository",
+ "fields": [
+ "actor",
+ "request_id",
+ "actor_id",
+ "repo",
+ "operation_type",
+ "created_at",
+ "_document_id",
+ "repo_id",
+ "user",
+ "@timestamp",
+ "visibility",
+ "user_agent",
+ "user_id",
+ "action",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/archiving-a-github-repository"
+ },
+ {
+ "action": "repo.update_actions_access_settings",
+ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "policy",
+ "old_policy",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "repo.update_actions_secret",
+ "description": "A GitHub Actions secret was updated for a repository.",
+ "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "key",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Using secrets in GitHub Actions"
+ },
+ {
+ "action": "repo.update_actions_settings",
+ "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "new_policy",
+ "old_policy",
+ "updated_access_policy",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repo.update_actions_variable",
+ "description": "A GitHub Actions variable was updated for a repository.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "repo.update_default_branch",
+ "description": "The default branch for a repository was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repo.update_integration_secret",
+ "description": "A Codespaces or Dependabot secret was updated for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "visibility",
+ "integration",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.update_member",
+ "description": "A user's permission to a repository was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "action",
+ "_document_id",
+ "actor",
+ "repo_id",
+ "created_at",
+ "oauth_application_id",
+ "user",
+ "@timestamp",
+ "repo",
+ "operation_type",
+ "request_id",
+ "org_id",
+ "actor_id",
+ "visibility",
+ "old_permission",
+ "org",
+ "user_id",
+ "old_base_role",
+ "old_repo_permission",
+ "old_repo_base_role",
+ "new_repo_base_role",
+ "new_repo_permission",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repository_branch_protection_evaluation.disable",
+ "description": "Branch protections were disabled for the repository.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "business_id",
+ "user",
+ "user_id",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+ },
+ {
+ "action": "repository_branch_protection_evaluation.enable",
+ "description": "Branch protections were enabled for this repository.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "business_id",
+ "user",
+ "user_id",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+ },
+ {
+ "action": "repository_code_security.disable",
+ "description": "Code security was disabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repository_code_security.enable",
+ "description": "Code security was enabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repository_image.create",
+ "description": "An image to represent a repository was uploaded.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "repo_id",
+ "action",
+ "request_id",
+ "actor",
+ "content_type",
+ "repo",
+ "@timestamp",
+ "_document_id",
+ "user",
+ "user_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_image.destroy",
+ "description": "An image to represent a repository was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "content_type",
+ "created_at",
+ "actor_id",
+ "user_id",
+ "operation_type",
+ "request_id",
+ "_document_id",
+ "actor",
+ "repo_id",
+ "user_agent",
+ "repo",
+ "user",
+ "action",
+ "@timestamp",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_invitation.accept",
+ "description": "An invitation to join a repository was accepted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "created_at",
+ "request_id",
+ "repo",
+ "invitee",
+ "operation_type",
+ "actor",
+ "repo_id",
+ "_document_id",
+ "action",
+ "user_agent",
+ "inviter",
+ "@timestamp",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repository_invitation.cancel",
+ "description": "An invitation to join a repository was canceled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "inviter",
+ "action",
+ "operation_type",
+ "_document_id",
+ "repo_id",
+ "repo",
+ "@timestamp",
+ "user_agent",
+ "invitee",
+ "created_at",
+ "request_id",
+ "actor",
+ "actor_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_invitation.create",
+ "description": "An invitation to join a repository was sent.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "invitee",
+ "action",
+ "request_id",
+ "inviter",
+ "repo",
+ "created_at",
+ "user_agent",
+ "repo_id",
+ "operation_type",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repository_invitation.reject",
+ "description": "An invitation to join a repository was declined.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "_document_id",
+ "actor",
+ "invitee",
+ "action",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "inviter",
+ "user_agent",
+ "repo_id"
+ ]
+ },
+ {
+ "action": "repository_ruleset.create",
+ "description": "A repository ruleset was created.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "ruleset_id",
+ "ruleset_name",
+ "ruleset_enforcement",
+ "ruleset_source_type",
+ "ruleset_rules",
+ "ruleset_conditions",
+ "ruleset_bypass_actors",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
+ },
+ {
+ "action": "repository_ruleset.destroy",
+ "description": "A repository ruleset was deleted.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "ruleset_id",
+ "ruleset_name",
+ "ruleset_enforcement",
+ "ruleset_source_type",
+ "ruleset_rules",
+ "ruleset_bypass_actors",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
+ },
+ {
+ "action": "repository_ruleset.update",
+ "description": "A repository ruleset was edited.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "old_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "ruleset_id",
+ "ruleset_name",
+ "ruleset_enforcement",
+ "ruleset_source_type",
+ "ruleset_rules_updated",
+ "ruleset_conditions_added",
+ "ruleset_conditions_deleted",
+ "ruleset_old_enforcement",
+ "ruleset_rules_added",
+ "ruleset_rules_deleted",
+ "ruleset_old_name",
+ "ruleset_conditions_updated",
+ "ruleset_bypass_actors_added",
+ "ruleset_bypass_actors_deleted",
+ "ruleset_bypass_actors_updated",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
+ },
+ {
+ "action": "repository_secret_scanning_automatic_validity_checks.disabled",
+ "description": "Automatic partner validation checks have been disabled at the repository level",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
+ },
+ {
+ "action": "repository_secret_scanning_automatic_validity_checks.enabled",
+ "description": "Automatic partner validation checks have been enabled at the repository level",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
+ },
+ {
+ "action": "repository_secret_scanning_custom_pattern.create",
+ "description": "A custom pattern was created for secret scanning in a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning_custom_pattern.delete",
+ "description": "A custom pattern was removed from secret scanning in a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning_custom_pattern.publish",
+ "description": "A custom pattern was published for secret scanning in a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning_custom_pattern_push_protection.disabled",
+ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning_custom_pattern_push_protection.enabled",
+ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning_custom_pattern.update",
+ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning.disable",
+ "description": "Secret scanning was disabled for a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "About secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning.enable",
+ "description": "Secret scanning was enabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repository_secret_scanning_non_provider_patterns.disabled",
+ "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
+ "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Supported secret scanning patterns"
+ },
+ {
+ "action": "repository_secret_scanning_non_provider_patterns.enabled",
+ "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
+ "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Supported secret scanning patterns"
+ },
+ {
+ "action": "repository_secret_scanning_push_protection_bypass_list.add",
+ "description": "A role or team was added to the push protection bypass list at the repository level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "repository_secret_scanning_push_protection_bypass_list.disable",
+ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "repository_secret_scanning_push_protection_bypass_list.enable",
+ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "repository_secret_scanning_push_protection_bypass_list.remove",
+ "description": "A role or team was removed from the push protection bypass list at the repository level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "repository_secret_scanning_push_protection.disable",
+ "description": "Secret scanning push protection was disabled for a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "repository_secret_scanning_push_protection.enable",
+ "description": "Secret scanning push protection was enabled for a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "repository_security_configuration.applied",
+ "description": "A code security configuration was applied to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "repository_security_configuration_state",
+ "repository_security_configuration_failure_reason",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_security_configuration.failed",
+ "description": "A code security configuration failed to attach to the repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "repository_security_configuration_failure_reason",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_security_configuration.removed",
+ "description": "A code security configuration was removed from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "repository_security_configuration_state",
+ "repository_security_configuration_failure_reason",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_security_configuration.removed_by_settings_change",
+ "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "repository_security_configuration_state",
+ "repository_security_configuration_failure_reason",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alert.auto_dismiss",
+ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "alert_id",
+ "alert_number",
+ "ghsa_id",
+ "action",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "owner",
+ "org",
+ "org_id",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About Dependabot auto-triage rules"
+ },
+ {
+ "action": "repository_vulnerability_alert.auto_reopen",
+ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "alert_id",
+ "alert_number",
+ "ghsa_id",
+ "action",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "owner",
+ "org",
+ "org_id",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About Dependabot auto-triage rules"
+ },
+ {
+ "action": "repository_vulnerability_alert.create",
+ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "operation_type",
+ "request_id",
+ "repo_id",
+ "@timestamp",
+ "user_agent",
+ "alert_id",
+ "action",
+ "repo",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "alert_number",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "repository_vulnerability_alert.dismiss",
+ "description": "A Dependabot alert was manually dismissed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo_id",
+ "org_id",
+ "user_id",
+ "request_id",
+ "@timestamp",
+ "operation_type",
+ "user_agent",
+ "alert_id",
+ "actor",
+ "repo",
+ "created_at",
+ "org",
+ "_document_id",
+ "action",
+ "actor_id",
+ "dismiss_reason",
+ "user",
+ "dismiss_comment",
+ "alert_number",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alert.reintroduce",
+ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "alert_id",
+ "created_at",
+ "action",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "owner",
+ "_document_id",
+ "@timestamp",
+ "operation_type",
+ "token_scopes",
+ "alert_number"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alert.reopen",
+ "description": "A Dependabot alert was manually reopened.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "alert_id",
+ "created_at",
+ "action",
+ "repo",
+ "repo_id",
+ "owner",
+ "org",
+ "org_id",
+ "_document_id",
+ "@timestamp",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo",
+ "alert_number",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alert.resolve",
+ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "alert_id",
+ "repo",
+ "operation_type",
+ "action",
+ "repo_id",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "@timestamp",
+ "created_at",
+ "actor",
+ "actor_id",
+ "token_scopes",
+ "alert_number",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alert.withdraw",
+ "description": "A Dependabot alert was withdrawn.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "alert_id",
+ "alert_number",
+ "ghsa_id",
+ "created_at",
+ "active",
+ "action",
+ "repository_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "owner",
+ "org",
+ "org_id",
+ "_document_id",
+ "@timestamp",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alerts.authorized_users_teams",
+ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
+ "fields": [
+ "org",
+ "_document_id",
+ "repo",
+ "org_id",
+ "operation_type",
+ "created_at",
+ "actor",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "repo_id",
+ "request_id",
+ "actor_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
+ },
+ {
+ "action": "repository_vulnerability_alerts_auto_dismissal.disable",
+ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alerts_auto_dismissal.enable",
+ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alerts.disable",
+ "description": "Dependabot alerts was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "request_id",
+ "repo_id",
+ "action",
+ "actor_id",
+ "@timestamp",
+ "created_at",
+ "actor",
+ "user_agent",
+ "org_id",
+ "user",
+ "org",
+ "_document_id",
+ "user_id",
+ "operation_type",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alerts.enable",
+ "description": "Dependabot alerts was enabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "user_agent",
+ "created_at",
+ "@timestamp",
+ "repo_id",
+ "action",
+ "user",
+ "repo",
+ "org",
+ "org_id",
+ "actor_id",
+ "_document_id",
+ "user_id",
+ "operation_type",
+ "request_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "restrict_notification_delivery.disable",
+ "description": "Email notification restrictions for an organization or enterprise were disabled.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "business",
+ "business_id",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
+ },
+ {
+ "action": "restrict_notification_delivery.enable",
+ "description": "Email notification restrictions for an organization or enterprise were enabled.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business_id",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
+ },
+ {
+ "action": "secret_scanning_alert.assign",
+ "description": "A user was assigned to a secret scanning alert.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "created_at"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning_alert.create",
+ "description": "GitHub detected a secret and created a secret scanning alert.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning_alert.reopen",
+ "description": "A secret scanning alert was reopened.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "number",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes",
+ "secret_type_display_name"
+ ]
+ },
+ {
+ "action": "secret_scanning_alert.resolve",
+ "description": "A secret scanning alert was resolved.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "number",
+ "resolution",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "secret_scanning_alert.revoke",
+ "description": "A secret scanning alert was revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "number",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "secret_scanning_alert.unassign",
+ "description": "A user was unassigned from a secret scanning alert.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "created_at"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning_alert.validate",
+ "description": "A secret scanning alert was validated.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "created_at",
+ "previous_validity",
+ "current_validity",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning.disable",
+ "description": "Secret scanning was disabled for all existing repositories.",
+ "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "About secret scanning"
+ },
+ {
+ "action": "secret_scanning.enable",
+ "description": "Secret scanning was enabled for all existing repositories.",
+ "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "About secret scanning"
+ },
+ {
+ "action": "secret_scanning_new_repos.disable",
+ "description": "Secret scanning was disabled for all new repositories.",
+ "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "About secret scanning"
+ },
+ {
+ "action": "secret_scanning_new_repos.enable",
+ "description": "Secret scanning was enabled for all new repositories.",
+ "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "About secret scanning"
+ },
+ {
+ "action": "secret_scanning_push_protection.bypass",
+ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "created_at",
+ "push_protection_bypass_reason",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "request_reviewer",
+ "request_reviewer_id"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "secret_scanning_push_protection_request.approve",
+ "description": "A request to bypass secret scanning push protection was approved by a user.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "number",
+ "repository",
+ "repository_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "secret_scanning_push_protection_request.deny",
+ "description": "A request to bypass secret scanning push protection was denied by a user.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "number",
+ "repository",
+ "repository_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header",
+ "request_reviewer_comment"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "secret_scanning_push_protection_request.request",
+ "description": "A user requested to bypass secret scanning push protection.",
+ "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "number",
+ "repository",
+ "repository_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
+ },
+ {
+ "action": "secret_scanning_scan.completed",
+ "description": "A secret scanning scan has completed on this repository.",
+ "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+ "fields": [
+ "repo_id",
+ "org_id",
+ "business_id",
+ "source",
+ "type",
+ "source_slug",
+ "type_slug",
+ "started_at",
+ "completed_at",
+ "repo",
+ "public_repo",
+ "org",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "secret_types",
+ "custom_pattern_name",
+ "custom_pattern_scope"
+ ],
+ "docs_reference_titles": "About secret scanning"
+ },
+ {
+ "action": "security_configuration.create",
+ "description": "A security configuration was created",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "security_configuration_description",
+ "security_configuration_created_at",
+ "security_configuration_updated_at",
+ "security_configuration_enable_ghas",
+ "security_configuration_private_vulnerability_reporting",
+ "security_configuration_dependency_graph",
+ "security_configuration_dependabot_alerts",
+ "security_configuration_dependabot_security_updates",
+ "security_configuration_code_scanning",
+ "security_configuration_secret_scanning",
+ "security_configuration_secret_scanning_push_protection",
+ "security_configuration_secret_scanning_validity_checks",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "security_configuration_dependency_graph_autosubmit_action",
+ "security_configuration_secret_scanning_non_provider_patterns",
+ "security_configuration_secret_scanning_delegated_bypass",
+ "security_configuration_secret_scanning_generic_secrets",
+ "security_configuration_secret_scanning_delegated_alert_dismissal",
+ "security_configuration_code_scanning_delegated_alert_dismissal",
+ "security_configuration_code_security_sku_enabled",
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
+ ]
+ },
+ {
+ "action": "security_configuration_default.delete",
+ "description": "A default security configuration setting for new repositories was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "default_for_new_private_repos",
+ "default_for_new_public_repos",
+ "security_configuration_name",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "security_configuration_default.update",
+ "description": "A default security configuration setting for new repositories was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "default_for_new_private_repos",
+ "default_for_new_public_repos",
+ "security_configuration_name",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "security_configuration.delete",
+ "description": "A security configuration was deleted",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "security_configuration_description",
+ "security_configuration_created_at",
+ "security_configuration_updated_at",
+ "security_configuration_enable_ghas",
+ "security_configuration_private_vulnerability_reporting",
+ "security_configuration_dependency_graph",
+ "security_configuration_dependabot_alerts",
+ "security_configuration_dependabot_security_updates",
+ "security_configuration_code_scanning",
+ "security_configuration_secret_scanning",
+ "security_configuration_secret_scanning_push_protection",
+ "security_configuration_secret_scanning_validity_checks",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "security_configuration_dependency_graph_autosubmit_action",
+ "security_configuration_secret_scanning_non_provider_patterns",
+ "security_configuration_secret_scanning_delegated_bypass",
+ "security_configuration_secret_scanning_delegated_alert_dismissal",
+ "security_configuration_code_scanning_delegated_alert_dismissal",
+ "security_configuration_code_security_sku_enabled",
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
+ ]
+ },
+ {
+ "action": "security_configuration_policy.update",
+ "description": "A security configuration policy was updated",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "enforcement",
+ "security_configuration_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "security_configuration.update",
+ "description": "A security configuration was updated",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "security_configuration_description",
+ "security_configuration_created_at",
+ "security_configuration_updated_at",
+ "security_configuration_enable_ghas",
+ "security_configuration_private_vulnerability_reporting",
+ "security_configuration_dependency_graph",
+ "security_configuration_dependabot_alerts",
+ "security_configuration_dependabot_security_updates",
+ "security_configuration_code_scanning",
+ "security_configuration_secret_scanning",
+ "security_configuration_secret_scanning_push_protection",
+ "security_configuration_secret_scanning_validity_checks",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "security_configuration_dependency_graph_autosubmit_action",
+ "security_configuration_secret_scanning_non_provider_patterns",
+ "security_configuration_secret_scanning_delegated_bypass",
+ "security_configuration_secret_scanning_generic_secrets",
+ "security_configuration_secret_scanning_delegated_alert_dismissal",
+ "security_configuration_code_scanning_delegated_alert_dismissal",
+ "security_configuration_code_security_sku_enabled",
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
+ ]
+ },
+ {
+ "action": "security_key.register",
+ "description": "A security key was registered for an account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user",
+ "created_at",
+ "user_id",
+ "action",
+ "operation_type",
+ "request_id",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "user_agent",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "security_key.remove",
+ "description": "A security key was removed from an account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "user_id",
+ "operation_type",
+ "_document_id",
+ "user_agent",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "action",
+ "created_at",
+ "user",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "social_identity.linked",
+ "description": "A user linked a social identity to their account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user_id",
+ "action",
+ "actor_id",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "social_identity.unlinked",
+ "description": "A user unlinked a social identity from their account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "social_identity.unlinked_all",
+ "description": "A user unlinked all social identities from their account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.agreement_sign",
+ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.custom_amount_settings_change",
+ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "sponsors_listing_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
+ },
+ {
+ "action": "sponsors.fiscal_host_change",
+ "description": "The fiscal host for a GitHub Sponsors listing was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "sponsors_listing_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.repo_funding_links_file_action",
+ "description": "The FUNDING file in a repository was changed.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
+ "fields": [
+ "@timestamp",
+ "action",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "repository",
+ "repository_id",
+ "actor",
+ "user_agent",
+ "actor_id",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_cancel",
+ "description": "A sponsorship was canceled.",
+ "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
+ "fields": [
+ "operation_type",
+ "_document_id",
+ "created_at",
+ "actor",
+ "user",
+ "action",
+ "actor_id",
+ "user_id",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Downgrading a sponsorship"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_create",
+ "description": "A sponsorship was created, by sponsoring an account.",
+ "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
+ "fields": [
+ "actor",
+ "user_id",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "user",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_payment_complete",
+ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
+ "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
+ "fields": [
+ "active",
+ "user",
+ "user_id",
+ "actor",
+ "actor_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_preference_change",
+ "description": "The option to receive email updates from a sponsored account was changed.",
+ "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
+ "fields": [
+ "actor_id",
+ "action",
+ "@timestamp",
+ "request_id",
+ "user_id",
+ "created_at",
+ "user",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_tier_change",
+ "description": "A sponsorship was upgraded or downgraded.",
+ "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
+ "fields": [
+ "user_id",
+ "actor",
+ "actor_id",
+ "action",
+ "user",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "created_at"
+ ],
+ "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
+ },
+ {
+ "action": "sponsors.sponsored_developer_approve",
+ "description": "A GitHub Sponsors account was approved.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
+ "fields": [
+ "user_id",
+ "action",
+ "user_agent",
+ "request_id",
+ "actor",
+ "user",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "actor_id",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+ },
+ {
+ "action": "sponsors.sponsored_developer_create",
+ "description": "A GitHub Sponsors account was created.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
+ "fields": [
+ "user_id",
+ "operation_type",
+ "request_id",
+ "actor_id",
+ "@timestamp",
+ "_document_id",
+ "user",
+ "action",
+ "created_at",
+ "user_agent",
+ "actor"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+ },
+ {
+ "action": "sponsors.sponsored_developer_disable",
+ "description": "A GitHub Sponsors account was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "sponsors.sponsored_developer_profile_update",
+ "description": "The profile for GitHub Sponsors account was edited.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
+ "fields": [
+ "@timestamp",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "request_id",
+ "actor",
+ "action",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
+ },
+ {
+ "action": "sponsors.sponsored_developer_redraft",
+ "description": "A GitHub Sponsors account was returned to draft state from approved state.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "created_at",
+ "request_id",
+ "user",
+ "action",
+ "user_agent",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "user_id"
+ ]
+ },
+ {
+ "action": "sponsors.sponsored_developer_request_approval",
+ "description": "An application for GitHub Sponsors was submitted for approval.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
+ "fields": [
+ "user_agent",
+ "user",
+ "@timestamp",
+ "actor_id",
+ "user_id",
+ "request_id",
+ "_document_id",
+ "actor",
+ "action",
+ "operation_type",
+ "created_at"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+ },
+ {
+ "action": "sponsors.sponsored_developer_tier_description_update",
+ "description": "The description for a sponsorship tier was changed.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
+ "fields": [
+ "operation_type",
+ "request_id",
+ "actor",
+ "user_id",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "user",
+ "created_at"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
+ },
+ {
+ "action": "sponsors.sponsored_developer_update_newsletter_send",
+ "description": "Triggered when you send an email update to your sponsors.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
+ "fields": [
+ "request_id",
+ "actor",
+ "action",
+ "user_agent",
+ "operation_type",
+ "_document_id",
+ "created_at",
+ "actor_id",
+ "user",
+ "user_id",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
+ },
+ {
+ "action": "sponsors.sponsors_patreon_user_create",
+ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "patreon_email",
+ "patreon_username",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account"
+ },
+ {
+ "action": "sponsors.sponsors_patreon_user_destroy",
+ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
+ "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "patreon_email",
+ "patreon_username",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Unlinking your Patreon account from GitHub"
+ },
+ {
+ "action": "sponsors.update_tier_repository",
+ "description": "A GitHub Sponsors tier changed access for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "repo",
+ "repo_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.update_tier_welcome_message",
+ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.waitlist_join",
+ "description": "You join the waitlist to join GitHub Sponsors.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
+ "fields": [
+ "request_id",
+ "actor",
+ "user_id",
+ "user_agent",
+ "actor_id",
+ "action",
+ "operation_type",
+ "created_at",
+ "user",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+ },
+ {
+ "action": "sponsors.withdraw_agreement_signature",
+ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "ssh_certificate_authority.create",
+ "description": "An SSH certificate authority for an organization or enterprise was created.",
+ "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
+ "fields": [
+ "@timestamp",
+ "_document_id",
+ "fingerprint",
+ "operation_type",
+ "openssh_public_key",
+ "org_id",
+ "actor",
+ "created_at",
+ "org",
+ "action",
+ "user_agent",
+ "actor_id",
+ "request_id"
+ ],
+ "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
+ },
+ {
+ "action": "ssh_certificate_authority.destroy",
+ "description": "An SSH certificate authority for an organization or enterprise was deleted.",
+ "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
+ "fields": [
+ "created_at",
+ "_document_id",
+ "fingerprint",
+ "operation_type",
+ "actor",
+ "org_id",
+ "openssh_public_key",
+ "org",
+ "action",
+ "user_agent",
+ "actor_id",
+ "@timestamp",
+ "request_id"
+ ],
+ "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
+ },
+ {
+ "action": "ssh_certificate_requirement.disable",
+ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
+ "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
+ "fields": [
+ "user",
+ "user_agent",
+ "operation_type",
+ "_document_id",
+ "request_id",
+ "org",
+ "org_id",
+ "created_at",
+ "actor",
+ "action",
+ "user_id",
+ "business",
+ "business_id",
+ "@timestamp",
+ "actor_id"
+ ],
+ "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
+ },
+ {
+ "action": "ssh_certificate_requirement.enable",
+ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
+ "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
+ "fields": [
+ "actor_id",
+ "user_id",
+ "org",
+ "operation_type",
+ "request_id",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "user",
+ "action",
+ "org_id",
+ "created_at",
+ "user_agent"
+ ],
+ "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
+ },
+ {
+ "action": "staff.set_domain_token_expiration",
+ "description": "The verification code expiry time for an organization or enterprise domain was set.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner_type",
+ "domain_name",
+ "business_id",
+ "token_expires_at",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "staff.unverify_domain",
+ "description": "An organization or enterprise domain was unverified.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "owner_type",
+ "domain_name",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "staff.verify_domain",
+ "description": "An organization or enterprise domain was verified.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "domain_name",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "sub_issues.parent_issue_add",
+ "description": "A parent issue was added to an issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "sub_issues.parent_issue_remove",
+ "description": "A parent issue was removed from an issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "sub_issues.sub_issue_add",
+ "description": "A sub-issue was added to an issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "sub_issues.sub_issue_remove",
+ "description": "A sub-issue was removed from an issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "successor_invitation.accept",
+ "description": "Triggered when you accept a succession invitation.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+ },
+ {
+ "action": "successor_invitation.cancel",
+ "description": "Triggered when you cancel a succession invitation.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+ },
+ {
+ "action": "successor_invitation.create",
+ "description": "Triggered when you create a succession invitation.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+ },
+ {
+ "action": "successor_invitation.decline",
+ "description": "Triggered when you decline a succession invitation.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+ },
+ {
+ "action": "successor_invitation.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "successor_invitation.revoke",
+ "description": "Triggered when you revoke a succession invitation.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+ },
+ {
+ "action": "team.add_member",
+ "description": "A member of an organization was added to a team.",
+ "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "org_id",
+ "user_id",
+ "team",
+ "user",
+ "@timestamp",
+ "actor_id",
+ "created_at",
+ "operation_type",
+ "_document_id",
+ "org",
+ "action",
+ "actor",
+ "programmatic_access_type",
+ "team_type"
+ ],
+ "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
+ },
+ {
+ "action": "team.add_repository",
+ "description": "A team was given access and permissions to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "team",
+ "action",
+ "operation_type",
+ "request_id",
+ "created_at",
+ "@timestamp",
+ "org",
+ "repo",
+ "actor_id",
+ "_document_id",
+ "repo_id",
+ "user_agent",
+ "org_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "team.add_to_organization",
+ "description": "A team was added to an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "team_type",
+ "team",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "team.change_parent_team",
+ "description": "A child team was created or a child team's parent was changed.",
+ "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
+ "fields": [
+ "org",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "team",
+ "action",
+ "operation_type",
+ "actor",
+ "request_id",
+ "actor_id",
+ "user_agent",
+ "org_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
+ },
+ {
+ "action": "team.change_privacy",
+ "description": "A team's privacy level was changed.",
+ "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "org",
+ "action",
+ "team",
+ "created_at",
+ "operation_type",
+ "actor_id",
+ "org_id",
+ "@timestamp",
+ "actor",
+ "_document_id",
+ "team_type"
+ ],
+ "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
+ },
+ {
+ "action": "team.create",
+ "description": "A new team is created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "oauth_application_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "org_id",
+ "user_agent",
+ "team",
+ "org",
+ "actor",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "team_type"
+ ]
+ },
+ {
+ "action": "team.demote_maintainer",
+ "description": "A user was demoted from a team maintainer to a team member.",
+ "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "team",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
+ },
+ {
+ "action": "team.destroy",
+ "description": "A team was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "org",
+ "team",
+ "org_id",
+ "actor_id",
+ "actor",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "operation_type",
+ "_document_id",
+ "programmatic_access_type",
+ "team_type"
+ ]
+ },
+ {
+ "action": "team_discussions.clear",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "business_id",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "user",
+ "business",
+ "action",
+ "request_id",
+ "created_at",
+ "user_id",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "team_discussions.disable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "action",
+ "operation_type",
+ "request_id",
+ "actor",
+ "org",
+ "created_at",
+ "actor_id",
+ "user",
+ "user_id",
+ "@timestamp",
+ "user_agent",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "team_discussions.enable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "@timestamp",
+ "action",
+ "_document_id",
+ "user_agent",
+ "user_id",
+ "business_id",
+ "request_id",
+ "user",
+ "business",
+ "operation_type",
+ "actor",
+ "created_at"
+ ]
+ },
+ {
+ "action": "team.promote_maintainer",
+ "description": "A user was promoted from a team member to a team maintainer.",
+ "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "team",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
+ },
+ {
+ "action": "team.remove_from_organization",
+ "description": "A team was removed from an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "team_type",
+ "team",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "team.remove_member",
+ "description": "An organization member was removed from a team.",
+ "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
+ "fields": [
+ "request_id",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "org",
+ "org_id",
+ "team",
+ "user_id",
+ "actor",
+ "user",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "team_type"
+ ],
+ "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
+ },
+ {
+ "action": "team.remove_repository",
+ "description": "A repository was removed from a team's control.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "org_id",
+ "repo",
+ "repo_id",
+ "action",
+ "_document_id",
+ "actor",
+ "@timestamp",
+ "actor_id",
+ "user_agent",
+ "created_at",
+ "team",
+ "org",
+ "operation_type",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "team.rename",
+ "description": "A team's name was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "name",
+ "user_agent",
+ "created_at",
+ "team",
+ "operation_type",
+ "actor_id",
+ "org",
+ "action",
+ "request_id",
+ "actor",
+ "org_id",
+ "@timestamp",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header",
+ "team_type"
+ ]
+ },
+ {
+ "action": "team_sync_tenant.disabled",
+ "description": "Team synchronization with a tenant was disabled.",
+ "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
+ "fields": [
+ "action",
+ "created_at",
+ "actor",
+ "request_id",
+ "org_id",
+ "actor_id",
+ "operation_type",
+ "_document_id",
+ "@timestamp",
+ "org",
+ "user_agent"
+ ],
+ "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
+ },
+ {
+ "action": "team_sync_tenant.enabled",
+ "description": "Team synchronization with a tenant was enabled.",
+ "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
+ "fields": [
+ "org_id",
+ "business_id",
+ "actor",
+ "created_at",
+ "user_agent",
+ "@timestamp",
+ "operation_type",
+ "business",
+ "actor_id",
+ "org",
+ "request_id",
+ "action",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
+ },
+ {
+ "action": "team.update_repository_permission",
+ "description": "A team's permission to a repository was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "team",
+ "org_id",
+ "@timestamp",
+ "org",
+ "_document_id",
+ "old_permission",
+ "request_id",
+ "repo",
+ "action",
+ "repo_id",
+ "actor",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "permission",
+ "new_repo_permission",
+ "new_repo_base_role",
+ "old_repo_permission",
+ "old_repo_base_role",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "trusted_device.register",
+ "description": "A new trusted device was added.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "trusted_device.remove",
+ "description": "A trusted device was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.abort",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "action",
+ "request_id",
+ "user_id",
+ "@timestamp",
+ "_document_id",
+ "user",
+ "user_agent",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.complete",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "@timestamp",
+ "created_at",
+ "user_id",
+ "operation_type",
+ "user",
+ "_document_id",
+ "user_agent",
+ "action"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.ignore",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "created_at",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "user",
+ "action"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.staff_approve",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "request_id",
+ "user",
+ "user_id",
+ "user_agent",
+ "operation_type",
+ "action",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.staff_decline",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "actor",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "operation_type",
+ "user",
+ "created_at",
+ "request_id",
+ "actor_id",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.start",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "created_at",
+ "user_id",
+ "action",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.two_factor_destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "user_id",
+ "action",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "user",
+ "_document_id",
+ "request_id"
+ ]
+ },
+ {
+ "action": "two_factor_authentication.add_factor",
+ "description": "A secondary authentication factor was added to a user account.",
+ "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
+ },
+ {
+ "action": "two_factor_authentication.disabled",
+ "description": "Two-factor authentication was disabled for a user account.",
+ "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
+ "fields": [
+ "actor",
+ "action",
+ "_document_id",
+ "user_agent",
+ "user",
+ "user_id",
+ "actor_id",
+ "created_at",
+ "operation_type",
+ "request_id",
+ "@timestamp",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Disabling two-factor authentication for your personal account"
+ },
+ {
+ "action": "two_factor_authentication.enabled",
+ "description": "Two-factor authentication was enabled for a user account.",
+ "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
+ "fields": [
+ "actor",
+ "operation_type",
+ "user_agent",
+ "action",
+ "created_at",
+ "actor_id",
+ "@timestamp",
+ "request_id",
+ "user",
+ "user_id",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Configuring two-factor authentication"
+ },
+ {
+ "action": "two_factor_authentication.password_reset_fallback_sms",
+ "description": "A one-time password code was sent to a user account fallback phone number.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "created_at",
+ "user",
+ "user_id",
+ "action",
+ "@timestamp",
+ "request_id",
+ "_document_id",
+ "user_agent"
+ ]
+ },
+ {
+ "action": "two_factor_authentication.recovery_codes_regenerated",
+ "description": "Two factor recovery codes were regenerated for a user account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor",
+ "operation_type",
+ "_document_id",
+ "user_id",
+ "action",
+ "user",
+ "user_agent",
+ "actor_id",
+ "@timestamp",
+ "created_at"
+ ]
+ },
+ {
+ "action": "two_factor_authentication.remove_factor",
+ "description": "A secondary authentication factor was removed from a user account.",
+ "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
+ },
+ {
+ "action": "two_factor_authentication.sign_in_fallback_sms",
+ "description": "A one-time password code was sent to a user account fallback phone number.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "operation_type",
+ "user_id",
+ "user",
+ "user_agent",
+ "created_at",
+ "_document_id",
+ "action",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "two_factor_authentication.update_fallback",
+ "description": "The two-factor authentication fallback for a user account was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "user",
+ "user_id",
+ "operation_type",
+ "user_agent",
+ "action",
+ "request_id",
+ "actor",
+ "actor_id"
+ ]
+ },
+ {
+ "action": "user.add_email",
+ "description": "An email address was added to a user account.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
+ "fields": [
+ "action",
+ "request_id",
+ "user",
+ "user_id",
+ "user_agent",
+ "operation_type",
+ "_document_id",
+ "actor_id",
+ "actor",
+ "email",
+ "@timestamp",
+ "created_at",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Adding an email address to your GitHub account"
+ },
+ {
+ "action": "user.async_delete",
+ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "user_id",
+ "created_at",
+ "user",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "actor_id",
+ "operation_type",
+ "user_agent",
+ "action",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.audit_log_export",
+ "description": "Audit log entries were exported.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user",
+ "action",
+ "request_id",
+ "actor",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "user_id",
+ "operation_type",
+ "created_at"
+ ]
+ },
+ {
+ "action": "user.block_user",
+ "description": "A user was blocked by another user.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "actor",
+ "user_id",
+ "_document_id",
+ "actor_id",
+ "@timestamp",
+ "user_agent",
+ "user",
+ "request_id",
+ "blocked_user",
+ "operation_type",
+ "created_at",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.change_password",
+ "description": "A user changed their password.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "actor_id",
+ "operation_type",
+ "actor",
+ "user",
+ "user_id",
+ "action",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.codespaces_trusted_repo_access_granted",
+ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
+ "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Managing access to other repositories within your codespace"
+ },
+ {
+ "action": "user.codespaces_trusted_repo_access_revoked",
+ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
+ "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Managing access to other repositories within your codespace"
+ },
+ {
+ "action": "user_content_edit.delete",
+ "description": "Triggered when a user content edit is deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor",
+ "user_content_id",
+ "user_content_type",
+ "created_at",
+ "user_agent",
+ "deleted_by",
+ "editor_id",
+ "_document_id",
+ "deleted_at",
+ "action",
+ "actor_id",
+ "editor",
+ "deleted_by_id",
+ "deleted_content",
+ "operation_type",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "user.correct_password_from_unrecognized_device",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "user_agent",
+ "created_at",
+ "user",
+ "action",
+ "operation_type",
+ "request_id",
+ "user_id",
+ "@timestamp",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.correct_password_from_unrecognized_device_and_location",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "operation_type",
+ "request_id",
+ "user_id",
+ "action",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.correct_password_from_unrecognized_location",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "request_id",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "user_id",
+ "@timestamp",
+ "user",
+ "action",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.create",
+ "description": "A new user account was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "email",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "request_id",
+ "user",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "action",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "user.create_integration_secret",
+ "description": "A user secret for Codespaces was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.creation_rate_limit_exceeded",
+ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "created_at",
+ "user_agent",
+ "_document_id",
+ "operation_type",
+ "oauth_application_id",
+ "action",
+ "actor",
+ "actor_id",
+ "request_id",
+ "user_id",
+ "@timestamp",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "user.delete",
+ "description": "A user account was destroyed by an asynchronous job.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "action",
+ "request_id",
+ "user_id",
+ "actor",
+ "actor_id",
+ "user",
+ "@timestamp",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.demote",
+ "description": "A site administrator was demoted to an ordinary user account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "oauth_application_id",
+ "action",
+ "user",
+ "created_at",
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "operation_type",
+ "_document_id",
+ "user_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.destroy",
+ "description": "A user deleted his or her account, triggering user.async_delete.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor",
+ "user",
+ "_document_id",
+ "created_at",
+ "user_agent",
+ "user_id",
+ "operation_type",
+ "actor_id",
+ "action",
+ "@timestamp",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.device_verification_failure",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor",
+ "created_at",
+ "_document_id",
+ "@timestamp",
+ "user",
+ "user_agent",
+ "user_id",
+ "actor_id",
+ "action",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.device_verification_requested",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "user_id",
+ "actor",
+ "operation_type",
+ "created_at",
+ "_document_id",
+ "@timestamp",
+ "user",
+ "actor_id",
+ "action",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.device_verification_success",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "user",
+ "_document_id",
+ "action",
+ "operation_type",
+ "user_agent",
+ "created_at",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.disable_collaborators_only",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "user.disable_contributors_only",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "user.disable_sockpuppet_disallowed",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "user_email.confirm_claim",
+ "description": "An enterprise managed user claimed an email address.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user_email.mark_as_unclaimed",
+ "description": "N/A",
+ "docs_reference_links": "An enterprise managed user unclaimed an email address.",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
+ },
+ {
+ "action": "user.enable_collaborators_only",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "user.enable_contributors_only",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "user.enable_sockpuppet_disallowed",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "user.failed_login",
+ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "action",
+ "operation_type",
+ "request_id",
+ "created_at",
+ "_document_id",
+ "@timestamp",
+ "user",
+ "org_id",
+ "actor",
+ "actor_id",
+ "user_agent"
+ ]
+ },
+ {
+ "action": "user.flag_as_large_scale_contributor",
+ "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "operation_type",
+ "@timestamp",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "user_agent",
+ "created_at"
+ ]
+ },
+ {
+ "action": "user.forgot_password",
+ "description": "A user requested a password reset.",
+ "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
+ "fields": [
+ "action",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "operation_type",
+ "@timestamp",
+ "email",
+ "created_at",
+ "user_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
+ },
+ {
+ "action": "user.grant_github_developer",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "created_at",
+ "user_agent",
+ "@timestamp",
+ "_document_id",
+ "user",
+ "user_id",
+ "actor",
+ "operation_type",
+ "request_id"
+ ]
+ },
+ {
+ "action": "user.hide_private_contributions_count",
+ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Manage visibility settings for private contributions"
+ },
+ {
+ "action": "user.login",
+ "description": "A user signed in.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "user_id",
+ "actor_id",
+ "@timestamp",
+ "user",
+ "action",
+ "operation_type",
+ "_document_id",
+ "request_id",
+ "created_at",
+ "actor",
+ "passkey_nickname",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.logout",
+ "description": "A user signed out.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.minimize_comment",
+ "description": "A comment made by a user was minimized.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "_document_id",
+ "user",
+ "user_id",
+ "action",
+ "request_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "user.new_device_used",
+ "description": "A user signed in from a new device.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "user_id",
+ "actor",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "actor_id",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.partial_two_factor_email_followup",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "operation_type",
+ "_document_id",
+ "action",
+ "@timestamp",
+ "created_at",
+ "user",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.promote",
+ "description": "An ordinary user account was promoted to a site administrator.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "action",
+ "actor",
+ "actor_id",
+ "user",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "oauth_application_id",
+ "request_id",
+ "operation_type",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.recreate",
+ "description": "A user's account was restored.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "user",
+ "action",
+ "actor_id",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "user_id",
+ "created_at",
+ "actor",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "user.remove_email",
+ "description": "An email address was removed from a user account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "user",
+ "user_id",
+ "operation_type",
+ "actor",
+ "actor_id",
+ "created_at",
+ "email",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "user.remove_integration_secret",
+ "description": "A user secret for Codespaces was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.remove_large_scale_contributor_flag",
+ "description": "A user account was no longer flagged as a large scale contributor.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "user.rename",
+ "description": "A username was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "action",
+ "request_id",
+ "actor_id",
+ "old_login",
+ "created_at",
+ "_document_id",
+ "actor",
+ "user_id",
+ "@timestamp",
+ "operation_type",
+ "user_agent",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "user.report_abuse",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "user_agent",
+ "request_id",
+ "action",
+ "@timestamp",
+ "created_at",
+ "org_id",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "user",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "user.report_content",
+ "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
+ "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam",
+ "fields": [
+ "org_id",
+ "request_id",
+ "user",
+ "user_agent",
+ "action",
+ "created_at",
+ "actor",
+ "operation_type",
+ "actor_id",
+ "user_id",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam"
+ },
+ {
+ "action": "user.reset_password",
+ "description": "A user reset their account password.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "user_agent",
+ "user",
+ "request_id",
+ "user_id",
+ "created_at",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user_session.country_change",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "request_id",
+ "user_id",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_agent",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "user.show_private_contributions_count",
+ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
+ "fields": [
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "user_id",
+ "action",
+ "actor",
+ "user",
+ "operation_type",
+ "user_agent",
+ "actor_id",
+ "created_at",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Manage visibility settings for private contributions"
+ },
+ {
+ "action": "user.sign_in_from_unrecognized_device",
+ "description": "A user signed in from an unrecognized device.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "action",
+ "_document_id",
+ "user_agent",
+ "user",
+ "user_id",
+ "operation_type",
+ "created_at",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.sign_in_from_unrecognized_device_and_location",
+ "description": "A user signed in from an unrecognized device and location.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "@timestamp",
+ "user_agent",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "action",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.sign_in_from_unrecognized_location",
+ "description": "A user signed in from an unrecognized location.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "user_id",
+ "action",
+ "operation_type",
+ "user_agent",
+ "user",
+ "_document_id",
+ "actor",
+ "created_at",
+ "actor_id",
+ "@timestamp",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user_status.destroy",
+ "description": "Triggered when you clear the status on your profile.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "user_id",
+ "actor",
+ "message",
+ "user",
+ "actor_id",
+ "created_at",
+ "request_id",
+ "limited_availability",
+ "action",
+ "emoji",
+ "operation_type",
+ "user_agent",
+ "@timestamp",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user_status.update",
+ "description": "Triggered when you set or change the status on your profile.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
+ "fields": [
+ "limited_availability",
+ "user",
+ "action",
+ "actor_id",
+ "message",
+ "user_id",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "emoji",
+ "org",
+ "actor",
+ "operation_type",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Personalize your profile"
+ },
+ {
+ "action": "user.suspend",
+ "description": "A user account was suspended.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "oauth_application_id",
+ "operation_type",
+ "actor_id",
+ "user",
+ "user_agent",
+ "request_id",
+ "actor",
+ "created_at",
+ "_document_id",
+ "@timestamp",
+ "user_id",
+ "action",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.toggle_warn_private_email",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "user",
+ "actor_id",
+ "@timestamp",
+ "operation_type",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "action",
+ "user_id",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.two_factor_challenge_failure",
+ "description": "A 2FA challenge issued for a user account failed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "user",
+ "actor_id",
+ "actor",
+ "user_id",
+ "@timestamp",
+ "action",
+ "request_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.two_factor_challenge_success",
+ "description": "A 2FA challenge issued for a user account succeeded.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "_document_id",
+ "user_id",
+ "operation_type",
+ "actor_id",
+ "user",
+ "actor",
+ "user_agent",
+ "request_id",
+ "action",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.two_factor_recover",
+ "description": "A user used their 2FA recovery codes.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "operation_type",
+ "user_agent",
+ "request_id",
+ "user",
+ "action",
+ "actor",
+ "actor_id",
+ "created_at",
+ "@timestamp",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.two_factor_recovery_codes_downloaded",
+ "description": "A user downloaded 2FA recovery codes for their account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "operation_type",
+ "actor_id",
+ "user",
+ "request_id",
+ "action",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "actor",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.two_factor_recovery_codes_printed",
+ "description": "A user printed 2FA recovery codes for their account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "action",
+ "operation_type",
+ "user_agent",
+ "request_id",
+ "user_id",
+ "created_at",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "user.two_factor_recovery_codes_viewed",
+ "description": "A user viewed 2FA recovery codes for their account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user_agent",
+ "actor",
+ "user_id",
+ "action",
+ "created_at",
+ "user",
+ "operation_type",
+ "@timestamp",
+ "request_id",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.two_factor_requested",
+ "description": "A user was prompted for a two-factor authentication code.",
+ "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
+ "fields": [
+ "user",
+ "actor_id",
+ "action",
+ "user_agent",
+ "request_id",
+ "created_at",
+ "_document_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "actor"
+ ],
+ "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
+ },
+ {
+ "action": "user.unblock_user",
+ "description": "A user was unblocked by another user.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "request_id",
+ "_document_id",
+ "blocked_user",
+ "operation_type",
+ "actor",
+ "@timestamp",
+ "user_agent",
+ "user_id",
+ "user",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.unminimize_comment",
+ "description": "A comment made by a user was unminimized.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "user_agent",
+ "_document_id",
+ "actor_id",
+ "user",
+ "user_id",
+ "operation_type",
+ "request_id",
+ "actor",
+ "action",
+ "created_at"
+ ]
+ },
+ {
+ "action": "user.unsuspend",
+ "description": "A user account was unsuspended.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "_document_id",
+ "user",
+ "action",
+ "user_agent",
+ "actor",
+ "oauth_application_id",
+ "operation_type",
+ "actor_id",
+ "created_at",
+ "@timestamp",
+ "user_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.update_integration_secret",
+ "description": "A user secret for Codespaces was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.update_new_repository_default_branch_setting",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.create",
+ "description": "A Dependabot rule was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.delete",
+ "description": "A Dependabot rule was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.disable",
+ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.enable",
+ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.force_disable",
+ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "action",
+ "org",
+ "org_id",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.force_enable",
+ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "action",
+ "org",
+ "org_id",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.update",
+ "description": "A Dependabot rule's conditions, actions, or metadata changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "workflows.approve_workflow_job",
+ "description": "A workflow job was approved.",
+ "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "workflow_run_id",
+ "run_number",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Reviewing deployments"
+ },
+ {
+ "action": "workflows.bypass_protection_rules",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "workflow_run_id",
+ "run_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "workflows.cancel_workflow_run",
+ "description": "A workflow run was cancelled.",
+ "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "started_at",
+ "event",
+ "name",
+ "workflow_run_id",
+ "head_branch",
+ "head_sha",
+ "run_number",
+ "cancelled_at",
+ "workflow_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "business",
+ "business_id",
+ "trigger_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Canceling a workflow run"
+ },
+ {
+ "action": "workflows.comment_workflow_job",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "token_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "workflow_run_id",
+ "run_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "workflows.completed_workflow_run",
+ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "started_at",
+ "event",
+ "name",
+ "workflow_run_id",
+ "head_branch",
+ "head_sha",
+ "completed_at",
+ "conclusion",
+ "run_number",
+ "workflow_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "business",
+ "business_id",
+ "trigger_id",
+ "run_attempt",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "Viewing workflow run history"
+ },
+ {
+ "action": "workflows.created_workflow_run",
+ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "started_at",
+ "event",
+ "name",
+ "workflow_run_id",
+ "head_branch",
+ "head_sha",
+ "workflow_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "business",
+ "business_id",
+ "trigger_id",
+ "public_repo",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "Understanding GitHub Actions"
+ },
+ {
+ "action": "workflows.delete_workflow_run",
+ "description": "A workflow run was deleted.",
+ "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "workflow_run_id",
+ "started_at",
+ "head_branch",
+ "head_sha",
+ "trigger_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Deleting a workflow run"
+ },
+ {
+ "action": "workflows.disable_workflow",
+ "description": "A workflow was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "workflow_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "workflows.enable_workflow",
+ "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "workflow_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "workflows.pin_workflow",
+ "description": "A workflow was pinned.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "workflow_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "workflows.prepared_workflow_job",
+ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
+ "fields": [
+ "repo_id",
+ "repo",
+ "org_id",
+ "org",
+ "business_id",
+ "business",
+ "workflow_run_id",
+ "job_name",
+ "runner_labels",
+ "is_hosted_runner",
+ "environment_name",
+ "secrets_passed",
+ "action",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "@timestamp",
+ "runner_owner_type",
+ "job_workflow_ref",
+ "calling_workflow_refs",
+ "calling_workflow_shas",
+ "imposer_repo"
+ ],
+ "docs_reference_titles": "Events that trigger workflows"
+ },
+ {
+ "action": "workflows.reject_workflow_job",
+ "description": "A workflow job was rejected.",
+ "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "workflow_run_id",
+ "run_number",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Reviewing deployments"
+ },
+ {
+ "action": "workflows.rerun_workflow_run",
+ "description": "A workflow run was re-run.",
+ "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "started_at",
+ "event",
+ "name",
+ "workflow_run_id",
+ "head_branch",
+ "head_sha",
+ "run_number",
+ "workflow_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "business",
+ "business_id",
+ "trigger_id",
+ "run_attempt",
+ "rerun_type",
+ "check_run_id",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Re-running workflows and jobs"
+ },
+ {
+ "action": "workflows.unpin_workflow",
+ "description": "A workflow was unpinned after previously being pinned.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "workflow_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ }
+]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.20/organization.json b/src/audit-logs/data/ghes-3.20/organization.json
new file mode 100644
index 000000000000..4131528a7e6e
--- /dev/null
+++ b/src/audit-logs/data/ghes-3.20/organization.json
@@ -0,0 +1,17680 @@
+[
+ {
+ "action": "account.billing_date_change",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "@timestamp",
+ "operation_type",
+ "user_agent",
+ "_document_id",
+ "created_at",
+ "action",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org_id"
+ ]
+ },
+ {
+ "action": "account.plan_change",
+ "description": "The account's plan changed.",
+ "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
+ "fields": [
+ "actor",
+ "operation_type",
+ "_document_id",
+ "user_agent",
+ "created_at",
+ "actor_id",
+ "request_id",
+ "@timestamp",
+ "user",
+ "action",
+ "user_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "How GitHub billing works"
+ },
+ {
+ "action": "actions_cache.delete",
+ "description": "A GitHub Actions cache was deleted using the REST API.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "user_id",
+ "user",
+ "repo_id",
+ "repo",
+ "org",
+ "org_id",
+ "actions_cache_id",
+ "actions_cache_key",
+ "actions_cache_version",
+ "actions_cache_scope",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "advisory_credit.accept",
+ "description": "Credit was accepted for a security advisory.",
+ "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "ghsa_id",
+ "repo",
+ "repo_id",
+ "recipient",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Editing a repository security advisory"
+ },
+ {
+ "action": "advisory_credit.create",
+ "description": "Someone was added to the credit section of a security advisory.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "ghsa_id",
+ "repo",
+ "repo_id",
+ "recipient",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "advisory_credit.decline",
+ "description": "Credit was declined for a security advisory.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "ghsa_id",
+ "repo",
+ "repo_id",
+ "recipient",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo"
+ ]
+ },
+ {
+ "action": "advisory_credit.destroy",
+ "description": "Someone was removed from the credit section of a security advisory.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "ghsa_id",
+ "repo",
+ "repo_id",
+ "recipient",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo"
+ ]
+ },
+ {
+ "action": "artifact.destroy",
+ "description": "A workflow run artifact was manually deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "actor",
+ "user_agent",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "request_id",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "operation_type",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "auto_approve_personal_access_token_requests.disable",
+ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
+ },
+ {
+ "action": "auto_approve_personal_access_token_requests.enable",
+ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
+ },
+ {
+ "action": "billing.budget_create",
+ "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "customer_id",
+ "target_amount",
+ "target_type",
+ "target_id",
+ "alert_enabled",
+ "status",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "pricing_target_type",
+ "pricing_target_id",
+ "budget_limit_type",
+ "alert_recipient_user_ids",
+ "exclude_cost_center_usage"
+ ]
+ },
+ {
+ "action": "billing.budget_delete",
+ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "customer_id",
+ "uuid",
+ "status",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "billing.budget_update",
+ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "customer_id",
+ "target_amount",
+ "target_type",
+ "target_id",
+ "alert_enabled",
+ "status",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header",
+ "old_target_amount",
+ "old_budget_limit_type",
+ "old_alert_enabled",
+ "old_target_id",
+ "old_pricing_target_type",
+ "old_pricing_target_id"
+ ]
+ },
+ {
+ "action": "billing.change_billing_type",
+ "description": "The way the account pays for GitHub was changed.",
+ "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
+ "fields": [
+ "actor_id",
+ "user",
+ "@timestamp",
+ "actor",
+ "user_id",
+ "action",
+ "created_at",
+ "operation_type",
+ "_document_id",
+ "user_agent",
+ "request_id"
+ ],
+ "docs_reference_titles": "Managing your payment and billing information"
+ },
+ {
+ "action": "billing.change_email",
+ "description": "The billing email address changed.",
+ "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
+ "fields": [
+ "actor",
+ "operation_type",
+ "actor_id",
+ "org_id",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "created_at",
+ "_document_id",
+ "org",
+ "email",
+ "action",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing your payment and billing information"
+ },
+ {
+ "action": "billing_customer.azure_subscription_linked",
+ "description": "Azure subscription has been linked on this account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "billing_customer.azure_subscription_unlinked",
+ "description": "Azure subscription has been unlinked on this account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "billing.lock",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "oauth_application_id",
+ "@timestamp",
+ "actor_id",
+ "operation_type",
+ "_document_id",
+ "request_id",
+ "actor",
+ "user",
+ "user_id",
+ "user_agent",
+ "created_at",
+ "action"
+ ]
+ },
+ {
+ "action": "billing.overage_policy_updated",
+ "description": "The premium request paid usage policy for your GitHub account was changed.",
+ "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage"
+ },
+ {
+ "action": "billing.unlock",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user",
+ "operation_type",
+ "user_agent",
+ "created_at",
+ "user_id",
+ "request_id",
+ "actor",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "checks.auto_trigger_disabled",
+ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
+ "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
+ "fields": [
+ "visibility",
+ "user_agent",
+ "user",
+ "@timestamp",
+ "repo",
+ "actor_id",
+ "user_id",
+ "action",
+ "created_at",
+ "actor",
+ "operation_type",
+ "request_id",
+ "repo_id",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
+ },
+ {
+ "action": "checks.auto_trigger_enabled",
+ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
+ "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo"
+ ],
+ "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
+ },
+ {
+ "action": "checks.delete_logs",
+ "description": "Logs in a check suite were deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "actor",
+ "actor_id",
+ "operation_type",
+ "repo_id",
+ "action",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "code_scanning.alert_appeared_in_branch",
+ "description": "Existing code scanning alerts appeared in a branch.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_number",
+ "commit_oid",
+ "ref",
+ "request_id",
+ "org_id",
+ "org",
+ "business_id",
+ "business",
+ "alert_numbers"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_closed_became_fixed",
+ "description": "Code scanning alerts were fixed.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_number",
+ "commit_oid",
+ "ref",
+ "request_id",
+ "org_id",
+ "org",
+ "business_id",
+ "business",
+ "alert_numbers"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_closed_became_outdated",
+ "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_numbers",
+ "commit_oid",
+ "ref",
+ "request_id",
+ "org_id",
+ "org",
+ "business_id",
+ "business"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_closed_by_user",
+ "description": "Code scanning alerts were manually dismissed.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_number",
+ "actor_id",
+ "request_id",
+ "actor",
+ "org_id",
+ "org",
+ "business_id",
+ "business",
+ "alert_numbers",
+ "dismissal_approver_id"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_closure_approved",
+ "description": "Dismissal of code scanning alerts was approved.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "dismissal_request_id",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_closure_denied",
+ "description": "Dismissal of code scanning alerts was denied.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "dismissal_request_id",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_closure_requested",
+ "description": "Dismissal of code scanning alerts was requested.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "dismissal_request_id",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_created",
+ "description": "Code scanning alerts were seen for the first time.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_number",
+ "commit_oid",
+ "ref",
+ "request_id",
+ "org_id",
+ "org",
+ "alert_numbers"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_reappeared",
+ "description": "Code scanning alerts that were previously fixed reappeared.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_number",
+ "commit_oid",
+ "ref",
+ "request_id",
+ "org_id",
+ "org",
+ "business_id",
+ "business",
+ "alert_numbers"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "code_scanning.alert_reopened_by_user",
+ "description": "Code scanning alerts that were previously dismissed were reopened.",
+ "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
+ "fields": [
+ "repo_id",
+ "alert_number",
+ "actor_id",
+ "request_id",
+ "actor",
+ "org_id",
+ "org",
+ "business_id",
+ "business",
+ "alert_numbers"
+ ],
+ "docs_reference_titles": "About code scanning"
+ },
+ {
+ "action": "codespaces.allow_permissions",
+ "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "origin_repository",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "codespaces.attempted_to_create_from_prebuild",
+ "description": "An attempt to create a codespace from a prebuild was made.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "owner",
+ "pull_request_id",
+ "repository",
+ "repository_id",
+ "user_id",
+ "user",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "codespaces.business_enablement_updated",
+ "description": "Enterprise setting for Codespaces ownership was updated.",
+ "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "enablement",
+ "organization_names",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
+ },
+ {
+ "action": "codespaces.connect",
+ "description": "Credentials for a codespace were refreshed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repository_id",
+ "repository",
+ "pull_request_id",
+ "user_id",
+ "org_id",
+ "owner",
+ "name",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "machine_type",
+ "devcontainer_path"
+ ]
+ },
+ {
+ "action": "codespaces.create",
+ "description": "A codespace was created",
+ "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repository_id",
+ "repository",
+ "pull_request_id",
+ "owner",
+ "name",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "machine_type",
+ "devcontainer_path"
+ ],
+ "docs_reference_titles": "Creating a codespace for a repository"
+ },
+ {
+ "action": "codespaces.destroy",
+ "description": "A user deleted a codespace.",
+ "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repository_id",
+ "repository",
+ "pull_request_id",
+ "owner",
+ "name",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Deleting a codespace"
+ },
+ {
+ "action": "codespaces.export_environment",
+ "description": "A codespace was exported to a branch on GitHub.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "owner",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo"
+ ]
+ },
+ {
+ "action": "codespaces.policy_group_created",
+ "description": "Policies were applied to codespaces in an organization or enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "codespaces.policy_group_deleted",
+ "description": "Policies were removed from codespaces in an organization or enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "codespaces.policy_group_updated",
+ "description": "Policies were updated for codespaces in an organization or enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "codespaces.restore",
+ "description": "A codespace was restored.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "codespaces.start_environment",
+ "description": "A codespace was started.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "org",
+ "owner",
+ "pull_request_id",
+ "machine_type",
+ "user_id",
+ "user",
+ "devcontainer_path",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "codespaces.suspend_environment",
+ "description": "A codespace was stopped.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "codespaces.trusted_repositories_access_update",
+ "description": "A personal account's access and security setting for Codespaces were updated.",
+ "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "business",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Managing access to other repositories within your codespace"
+ },
+ {
+ "action": "commit_comment.destroy",
+ "description": "A commit comment was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "repo",
+ "org",
+ "org_id",
+ "created_at",
+ "@timestamp",
+ "operation_type",
+ "repo_id",
+ "actor_id",
+ "request_id",
+ "_document_id",
+ "user_agent",
+ "action",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "commit_comment.update",
+ "description": "A commit comment was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "repo_id",
+ "actor",
+ "org",
+ "request_id",
+ "action",
+ "@timestamp",
+ "repo",
+ "org_id",
+ "actor_id",
+ "created_at",
+ "user_agent",
+ "operation_type",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "copilot.access_revoked",
+ "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "reason",
+ "plan",
+ "org_id",
+ "owner",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.cfb_org_settings_changed",
+ "description": "Copilot feature settings were changed at the organization level.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_added",
+ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "token_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_assignment_created",
+ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
+ "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "What is GitHub Copilot?"
+ },
+ {
+ "action": "copilot.cfb_seat_assignment_refreshed",
+ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_assignment_reused",
+ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_assignment_unassigned",
+ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_cancelled",
+ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "seat_assignment",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_cancelled_by_staff",
+ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user_id",
+ "user",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_management_changed",
+ "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "old_value",
+ "new_value",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.content_exclusion_changed",
+ "description": "The excluded paths for GitHub Copilot were updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "excluded_paths",
+ "owner_type",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "copilot.custom_instructions_created",
+ "description": "Copilot custom instructions were created for the organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "custom_instructions"
+ ]
+ },
+ {
+ "action": "copilot.custom_instructions_updated",
+ "description": "Copilot custom instructions were updated for the organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "custom_instructions"
+ ]
+ },
+ {
+ "action": "copilot.plan_changed",
+ "description": "The plan for GitHub Copilot was updated.",
+ "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "old_plan",
+ "plan",
+ "business_id",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "GitHub Copilot licenses"
+ },
+ {
+ "action": "copilot.plan_downgrade_scheduled",
+ "description": "The plan for GitHub Copilot was scheduled to be downgraded.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org_id",
+ "owner",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "current_plan",
+ "scheduled_plan"
+ ]
+ },
+ {
+ "action": "copilot.swe_agent_mcp_config_updated",
+ "description": "MCP Configuration for Copilot coding agent was updated for a specific repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "new_config",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "copilot.swe_agent_repo_disabled",
+ "description": "Specific repositories were disabled from using Copilot coding agent.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "org_id",
+ "owner_type",
+ "actor_id",
+ "owner",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "copilot.swe_agent_repo_enabled",
+ "description": "Specific repositories were enabled to use Copilot coding agent.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "org_id",
+ "owner_type",
+ "owner",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "copilot.swe_agent_repo_enablement_updated",
+ "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "new_access",
+ "old_access",
+ "org_id",
+ "owner_type",
+ "owner",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "custom_hosted_runner.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "runner_group_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "custom_hosted_runner.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "custom_hosted_runner.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "runner_group_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "custom_property_definition.create",
+ "description": "A new custom property definition was created.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "property_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "value_type",
+ "required",
+ "default_value",
+ "definition_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
+ },
+ {
+ "action": "custom_property_definition.destroy",
+ "description": "A custom property definition was deleted.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "property_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "value_type",
+ "required",
+ "default_value",
+ "definition_id",
+ "allowed_values"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
+ },
+ {
+ "action": "custom_property_definition.update",
+ "description": "A custom property definition was updated.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "property_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "value_type",
+ "required",
+ "default_value",
+ "old_allowed_values",
+ "allowed_values",
+ "definition_id",
+ "old_required",
+ "old_default_value",
+ "old_value_type",
+ "old_values_editable_by",
+ "values_editable_by",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
+ },
+ {
+ "action": "custom_property_value.create",
+ "description": "A repository's custom property value was manually set for the first time.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "definition_id",
+ "property_name",
+ "value",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
+ },
+ {
+ "action": "custom_property_value.destroy",
+ "description": "A repository's custom property value was deleted.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repository",
+ "repository_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
+ },
+ {
+ "action": "custom_property_value.update",
+ "description": "A repository's custom property value was updated.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repository",
+ "repository_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "definition_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
+ },
+ {
+ "action": "dependabot_alerts.disable",
+ "description": "Dependabot alerts were disabled for all existing repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
+ },
+ {
+ "action": "dependabot_alerts.enable",
+ "description": "Dependabot alerts were enabled for all existing repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
+ },
+ {
+ "action": "dependabot_alerts_new_repos.disable",
+ "description": "Dependabot alerts were disabled for all new repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
+ },
+ {
+ "action": "dependabot_alerts_new_repos.enable",
+ "description": "Dependabot alerts were enabled for all new repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
+ },
+ {
+ "action": "dependabot_repository_access.default_access_level_updated",
+ "description": "The default repository access for Dependabot was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "org",
+ "org_id",
+ "access_level",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "dependabot_repository_access.repositories_updated",
+ "description": "The repositories that Dependabot can access were updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "dependabot_security_updates.disable",
+ "description": "Dependabot security updates were disabled for all existing repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+ },
+ {
+ "action": "dependabot_security_updates.enable",
+ "description": "Dependabot security updates were enabled for all existing repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "dependabot_security_updates_new_repos.disable",
+ "description": " Dependabot security updates were disabled for all new repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+ },
+ {
+ "action": "dependabot_security_updates_new_repos.enable",
+ "description": "Dependabot security updates were enabled for all new repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "dependency_graph.disable",
+ "description": "The dependency graph was disabled for all existing repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+ },
+ {
+ "action": "dependency_graph.enable",
+ "description": "The dependency graph was enabled for all existing repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "dependency_graph_new_repos.disable",
+ "description": "The dependency graph was disabled for all new repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+ },
+ {
+ "action": "dependency_graph_new_repos.enable",
+ "description": "The dependency graph was enabled for all new repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "discussion_comment.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "org",
+ "repo_id",
+ "request_id",
+ "action",
+ "actor",
+ "org_id",
+ "_document_id",
+ "actor_id",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "discussion_comment.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo_id",
+ "@timestamp",
+ "actor",
+ "user_agent",
+ "request_id",
+ "org",
+ "_document_id",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "repo",
+ "org_id",
+ "action",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "discussion.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo_id",
+ "user_agent",
+ "actor_id",
+ "org_id",
+ "actor",
+ "org",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "request_id",
+ "title",
+ "_document_id",
+ "created_at",
+ "repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "discussion_post.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "team",
+ "created_at",
+ "user_id",
+ "@timestamp",
+ "number",
+ "org",
+ "title",
+ "actor",
+ "actor_id",
+ "user",
+ "action",
+ "user_agent",
+ "operation_type",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "discussion_post_reply.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "operation_type",
+ "user_id",
+ "actor",
+ "number",
+ "user",
+ "created_at",
+ "request_id",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "discussion_post_reply.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "_document_id",
+ "request_id",
+ "org",
+ "@timestamp",
+ "actor_id",
+ "operation_type",
+ "user",
+ "user_id",
+ "org_id",
+ "user_agent",
+ "actor",
+ "number",
+ "team",
+ "created_at"
+ ]
+ },
+ {
+ "action": "discussion_post.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "_document_id",
+ "title",
+ "user",
+ "user_agent",
+ "org",
+ "operation_type",
+ "actor_id",
+ "@timestamp",
+ "actor",
+ "team",
+ "action",
+ "org_id",
+ "request_id",
+ "user_id",
+ "number"
+ ]
+ },
+ {
+ "action": "enterprise_announcement.create",
+ "description": "A global announcement banner was created for the enterprise.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "owner",
+ "owner_type",
+ "business_id",
+ "message",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Customizing user messages for your enterprise"
+ },
+ {
+ "action": "enterprise_announcement.destroy",
+ "description": "A global announcement banner was removed from the enterprise.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "owner",
+ "owner_type",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Customizing user messages for your enterprise"
+ },
+ {
+ "action": "enterprise_announcement.update",
+ "description": "A global announcement banner was updated for the enterprise.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "owner",
+ "owner_type",
+ "business_id",
+ "message",
+ "old_message",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Customizing user messages for your enterprise"
+ },
+ {
+ "action": "enterprise_installation.create",
+ "description": "The GitHub App associated with a GitHub Connect connection was created.",
+ "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
+ "fields": [
+ "created_at",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "org_id",
+ "action",
+ "request_id",
+ "org",
+ "actor_id",
+ "user_agent",
+ "actor"
+ ],
+ "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
+ },
+ {
+ "action": "enterprise_installation.destroy",
+ "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
+ "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
+ "fields": [
+ "created_at",
+ "_document_id",
+ "action",
+ "@timestamp",
+ "actor_id",
+ "actor",
+ "user_agent",
+ "org",
+ "operation_type",
+ "request_id",
+ "org_id"
+ ],
+ "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
+ },
+ {
+ "action": "environment.add_protection_rule",
+ "description": "A GitHub Actions deployment protection rule was created via the API.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "environment_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "environment.create_actions_secret",
+ "description": "A secret was created for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "key",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.create_actions_variable",
+ "description": "A variable was created for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "environment_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "environment.delete",
+ "description": "An environment was deleted.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.remove_actions_secret",
+ "description": "A secret was deleted for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "key",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "public_repo",
+ "token_scopes",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.remove_actions_variable",
+ "description": "A variable was deleted for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "environment_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "environment.remove_protection_rule",
+ "description": "A GitHub Actions deployment protection rule was deleted via the API.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.update_actions_secret",
+ "description": "A secret was updated for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "key",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.update_actions_variable",
+ "description": "A variable was updated for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "environment_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "environment.update_protection_rule",
+ "description": "A GitHub Actions deployment protection rule was updated via the API.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "new_value",
+ "approvers_was",
+ "approvers",
+ "programmatic_access_type",
+ "can_admins_bypass",
+ "prevent_self_review"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "git.clone",
+ "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "transport_protocol",
+ "request_id",
+ "repository",
+ "repository_id",
+ "repository_public",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "transport_protocol_name"
+ ]
+ },
+ {
+ "action": "git.fetch",
+ "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "transport_protocol",
+ "request_id",
+ "repository",
+ "repository_id",
+ "repository_public",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "transport_protocol_name"
+ ]
+ },
+ {
+ "action": "git.push",
+ "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "transport_protocol",
+ "request_id",
+ "repository",
+ "repository_id",
+ "repository_public",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "transport_protocol_name"
+ ]
+ },
+ {
+ "action": "github_hosted_runner.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "runner_group_id",
+ "business",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "github_hosted_runner.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "github_hosted_runner.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "runner_group_id",
+ "business",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "hook.active_changed",
+ "description": "A hook's active status was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "name",
+ "events",
+ "active",
+ "active_was",
+ "hook_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "hook.config_changed",
+ "description": "A hook's configuration was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "name",
+ "org",
+ "user_agent",
+ "request_id",
+ "hook_id",
+ "repo",
+ "repo_id",
+ "created_at",
+ "oauth_application_id",
+ "action",
+ "events",
+ "org_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "hook.create",
+ "description": "A new hook was added.",
+ "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
+ "fields": [
+ "oauth_application",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "repo_id",
+ "request_id",
+ "hook_id",
+ "events",
+ "repo",
+ "@timestamp",
+ "operation_type",
+ "name",
+ "action",
+ "created_at",
+ "org_id",
+ "org",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "About webhooks"
+ },
+ {
+ "action": "hook.destroy",
+ "description": "A hook was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "events",
+ "repo",
+ "created_at",
+ "org",
+ "name",
+ "request_id",
+ "actor_id",
+ "repo_id",
+ "org_id",
+ "action",
+ "operation_type",
+ "oauth_application_id",
+ "user_agent",
+ "hook_id",
+ "@timestamp",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "hook.events_changed",
+ "description": "A hook's configured events were changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "events",
+ "repo",
+ "operation_type",
+ "action",
+ "_document_id",
+ "actor_id",
+ "name",
+ "events_were",
+ "@timestamp",
+ "created_at",
+ "hook_id",
+ "repo_id",
+ "org_id",
+ "org",
+ "user_agent",
+ "request_id",
+ "oauth_application_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "integration.create",
+ "description": "A GitHub App was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "actor",
+ "user_agent",
+ "actor_id",
+ "request_id",
+ "name",
+ "user_id",
+ "_document_id",
+ "integration",
+ "created_at",
+ "programmatic_access_type",
+ "request_access_security_header",
+ "application_client_id"
+ ]
+ },
+ {
+ "action": "integration.destroy",
+ "description": "A GitHub App was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "user_id",
+ "actor_id",
+ "request_id",
+ "@timestamp",
+ "name",
+ "integration",
+ "user",
+ "_document_id",
+ "action",
+ "operation_type",
+ "created_at",
+ "user_agent"
+ ]
+ },
+ {
+ "action": "integration.generate_client_secret",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "integration",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header",
+ "application_client_id"
+ ]
+ },
+ {
+ "action": "integration_installation.create",
+ "description": "A GitHub App was installed.",
+ "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
+ "fields": [
+ "operation_type",
+ "@timestamp",
+ "name",
+ "request_id",
+ "repository_selection",
+ "user_id",
+ "action",
+ "user_agent",
+ "user",
+ "created_at",
+ "integration",
+ "_document_id",
+ "programmatic_access_type",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
+ },
+ {
+ "action": "integration_installation.destroy",
+ "description": "A GitHub App was uninstalled.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
+ "fields": [
+ "@timestamp",
+ "request_id",
+ "actor",
+ "created_at",
+ "_document_id",
+ "repository_selection",
+ "integration",
+ "user_id",
+ "user",
+ "action",
+ "operation_type",
+ "name",
+ "actor_id",
+ "user_agent",
+ "programmatic_access_type",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
+ },
+ {
+ "action": "integration_installation.repositories_added",
+ "description": "Repositories were added to a GitHub App.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
+ "fields": [
+ "user_id",
+ "repository_selection",
+ "name",
+ "user",
+ "request_id",
+ "integration",
+ "operation_type",
+ "actor_id",
+ "action",
+ "repositories_added",
+ "created_at",
+ "_document_id",
+ "@timestamp",
+ "actor",
+ "user_agent",
+ "token_scopes",
+ "repositories_added_names",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
+ },
+ {
+ "action": "integration_installation.repositories_removed",
+ "description": "Repositories were removed from a GitHub App.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
+ "fields": [
+ "user",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "repository_selection",
+ "repositories_removed",
+ "integration",
+ "user_id",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "@timestamp",
+ "name",
+ "action",
+ "actor_id",
+ "repositories_removed_names",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
+ },
+ {
+ "action": "integration_installation_request.close",
+ "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
+ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
+ "fields": [
+ "url",
+ "actor",
+ "actor_id",
+ "created_at",
+ "request_id",
+ "operation_type",
+ "@timestamp",
+ "integration",
+ "action",
+ "user_agent",
+ "reason",
+ "_document_id",
+ "org",
+ "org_id",
+ "request_access_security_header",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
+ },
+ {
+ "action": "integration_installation_request.create",
+ "description": "A member requested that an owner install a GitHub App.",
+ "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
+ "fields": [
+ "@timestamp",
+ "actor_id",
+ "org",
+ "_document_id",
+ "requester",
+ "action",
+ "user_agent",
+ "created_at",
+ "url",
+ "org_id",
+ "request_id",
+ "operation_type",
+ "actor",
+ "integration",
+ "request_access_security_header",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
+ },
+ {
+ "action": "integration_installation.suspend",
+ "description": "A GitHub App was suspended.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "name",
+ "repository_selection",
+ "actor_id",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
+ },
+ {
+ "action": "integration_installation.unsuspend",
+ "description": "A GitHub App was unsuspended.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "name",
+ "repository_selection",
+ "actor_id",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
+ },
+ {
+ "action": "integration_installation.version_updated",
+ "description": "Permissions for a GitHub App were updated.",
+ "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
+ "fields": [
+ "integration",
+ "user_id",
+ "user_agent",
+ "name",
+ "user",
+ "operation_type",
+ "actor_id",
+ "action",
+ "_document_id",
+ "request_id",
+ "created_at",
+ "repository_selection",
+ "@timestamp",
+ "actor",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
+ },
+ {
+ "action": "integration.manager_added",
+ "description": "A member of an enterprise or organization was added as a GitHub App manager.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
+ "fields": [
+ "created_at",
+ "action",
+ "_document_id",
+ "name",
+ "org_id",
+ "manager",
+ "operation_type",
+ "actor",
+ "integration",
+ "org",
+ "@timestamp",
+ "actor_id",
+ "request_id",
+ "user_agent"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
+ },
+ {
+ "action": "integration.manager_removed",
+ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "org",
+ "operation_type",
+ "integration",
+ "org_id",
+ "_document_id",
+ "action",
+ "actor",
+ "name",
+ "created_at",
+ "manager",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
+ },
+ {
+ "action": "integration.remove_client_secret",
+ "description": "A client secret for a GitHub App was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "integration.revoke_all_tokens",
+ "description": "All user tokens for a GitHub App were requested to be revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "application_client_id"
+ ]
+ },
+ {
+ "action": "integration.revoke_tokens",
+ "description": "Token(s) for a GitHub App were revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "application_client_id"
+ ]
+ },
+ {
+ "action": "integration.suspend",
+ "description": "A GitHub App was suspended.",
+ "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
+ },
+ {
+ "action": "integration.transfer",
+ "description": "Ownership of a GitHub App was transferred to another user or organization.",
+ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
+ "fields": [
+ "@timestamp",
+ "user_id",
+ "name",
+ "transfer_to_id",
+ "user",
+ "requester",
+ "action",
+ "requester_id",
+ "actor_id",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "transfer_to",
+ "operation_type",
+ "request_id",
+ "actor",
+ "integration",
+ "transfer_from",
+ "transfer_from_id",
+ "transfer_from_type",
+ "transfer_to_type"
+ ],
+ "docs_reference_titles": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
+ },
+ {
+ "action": "integration.unsuspend",
+ "description": "A GitHub App was unsuspended.",
+ "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
+ },
+ {
+ "action": "ip_allow_list.disable",
+ "description": "An IP allow list was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "actor",
+ "request_id",
+ "org",
+ "user_agent",
+ "_document_id",
+ "user_id",
+ "actor_id",
+ "created_at",
+ "org_id",
+ "action",
+ "@timestamp",
+ "user"
+ ]
+ },
+ {
+ "action": "ip_allow_list.disable_for_installed_apps",
+ "description": "An IP allow list was disabled for installed GitHub Apps.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "ip_allow_list.enable",
+ "description": "An IP allow list was enabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "business",
+ "user_id",
+ "request_id",
+ "actor",
+ "user",
+ "business_id",
+ "_document_id",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "actor_id",
+ "operation_type",
+ "org",
+ "created_at"
+ ]
+ },
+ {
+ "action": "ip_allow_list.enable_for_installed_apps",
+ "description": "An IP allow list was enabled for installed GitHub Apps.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "ip_allow_list_entry.create",
+ "description": "An IP address was added to an IP allow list.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "active",
+ "org",
+ "ip_allow_list_entry",
+ "@timestamp",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "action",
+ "request_id",
+ "actor_id",
+ "business_id",
+ "org_id",
+ "business",
+ "actor",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "ip_allow_list_entry.destroy",
+ "description": "An IP address was deleted from an IP allow list.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "request_id",
+ "ip_allow_list_entry",
+ "org",
+ "operation_type",
+ "created_at",
+ "active",
+ "action",
+ "@timestamp",
+ "business",
+ "business_id",
+ "user_agent",
+ "org_id",
+ "actor",
+ "actor_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "ip_allow_list_entry.update",
+ "description": "An IP address or its description was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "_document_id",
+ "actor",
+ "org",
+ "action",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "actor_id",
+ "ip_allow_list_entry",
+ "active",
+ "org_id",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "issue_comment.destroy",
+ "description": "A comment on an issue was deleted from the repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "org",
+ "repo",
+ "actor_id",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "action",
+ "operation_type",
+ "user_agent",
+ "repo_id",
+ "actor",
+ "request_id",
+ "oauth_application_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "issue_comment.pinned",
+ "description": "A comment on an issue was pinned to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_comment.unpinned",
+ "description": "A comment on an issue was unpinned from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_comment.update",
+ "description": "A comment on an issue (other than the initial one) changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "org",
+ "action",
+ "repo_id",
+ "org_id",
+ "created_at",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "_document_id",
+ "actor_id",
+ "actor",
+ "oauth_application_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "issue_dependencies.blocked_by_add",
+ "description": "An issue was marked as blocked by another issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_dependencies.blocked_by_remove",
+ "description": "The blocked by relationship between an issue and another issue was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "title",
+ "org",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "issue_dependencies.blocking_add",
+ "description": "An issue was marked as blocking another issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_dependencies.blocking_remove",
+ "description": "The blocking relationship between an issue and another issue was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue.destroy",
+ "description": "An issue was deleted from the repository.",
+ "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue",
+ "fields": [
+ "user",
+ "actor_id",
+ "created_at",
+ "title",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "actor",
+ "user_id",
+ "action",
+ "operation_type",
+ "user_agent",
+ "repo",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Deleting an issue"
+ },
+ {
+ "action": "issue.pinned",
+ "description": "An issue was pinned to a repository.",
+ "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
+ "fields": [
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "created_at",
+ "action",
+ "actor",
+ "operation_type",
+ "owner_type",
+ "@timestamp",
+ "repo_id",
+ "request_id",
+ "number",
+ "repo",
+ "event",
+ "user",
+ "user_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Pinning an issue to your repository"
+ },
+ {
+ "action": "issue.transfer",
+ "description": "An issue was transferred to another repository.",
+ "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository",
+ "fields": [
+ "user",
+ "user_id",
+ "@timestamp",
+ "user_agent",
+ "owner_type",
+ "actor_id",
+ "number",
+ "repo",
+ "operation_type",
+ "_document_id",
+ "repo_id",
+ "action",
+ "request_id",
+ "created_at",
+ "actor",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Transferring an issue to another repository"
+ },
+ {
+ "action": "issue_type.create",
+ "description": "An issue type was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "issue_type_name",
+ "description",
+ "color",
+ "enabled",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_type.destroy",
+ "description": "An issue type was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "issue_type_name",
+ "description",
+ "color",
+ "enabled",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_type.update",
+ "description": "An issue type was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "issue_type_name",
+ "description",
+ "color",
+ "enabled",
+ "old_issue_type_name",
+ "old_description",
+ "old_color",
+ "old_enabled",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue.unpinned",
+ "description": "An issue was unpinned from a repository.",
+ "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
+ "fields": [
+ "event",
+ "user_agent",
+ "actor_id",
+ "repo_id",
+ "actor",
+ "action",
+ "created_at",
+ "request_id",
+ "repo",
+ "operation_type",
+ "_document_id",
+ "number",
+ "owner_type",
+ "@timestamp",
+ "user",
+ "user_id",
+ "token_scopes",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Pinning an issue to your repository"
+ },
+ {
+ "action": "issues.deletes_disabled",
+ "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
+ "fields": [
+ "user_agent",
+ "action",
+ "@timestamp",
+ "operation_type",
+ "request_id",
+ "actor_id",
+ "user_id",
+ "created_at",
+ "_document_id",
+ "actor",
+ "user",
+ "org",
+ "org_id"
+ ],
+ "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+ },
+ {
+ "action": "issues.deletes_enabled",
+ "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
+ "fields": [
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "request_id",
+ "actor",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+ },
+ {
+ "action": "issues.deletes_policy_cleared",
+ "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
+ "fields": [
+ "user",
+ "request_id",
+ "actor",
+ "business_id",
+ "action",
+ "operation_type",
+ "user_agent",
+ "created_at",
+ "@timestamp",
+ "_document_id",
+ "business",
+ "user_id",
+ "actor_id"
+ ],
+ "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+ },
+ {
+ "action": "marketplace_agreement_signature.create",
+ "description": "The GitHub Marketplace Developer Agreement was signed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "operation_type",
+ "created_at",
+ "action",
+ "user",
+ "user_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "marketplace_listing.approve",
+ "description": "A listing was approved for inclusion in GitHub Marketplace.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "secondary_category",
+ "actor",
+ "primary_category",
+ "user",
+ "@timestamp",
+ "_document_id",
+ "user_id",
+ "user_agent",
+ "operation_type",
+ "created_at",
+ "request_id",
+ "actor_id",
+ "marketplace_listing",
+ "integration",
+ "action"
+ ]
+ },
+ {
+ "action": "marketplace_listing.change_category",
+ "description": "A category for a listing for an app in GitHub Marketplace was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "primary_category",
+ "user_agent",
+ "request_id",
+ "actor",
+ "marketplace_listing",
+ "@timestamp",
+ "integration",
+ "org_id",
+ "action",
+ "org",
+ "secondary_category",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "marketplace_listing.create",
+ "description": "A listing for an app in GitHub Marketplace was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "primary_category",
+ "_document_id",
+ "user",
+ "created_at",
+ "user_agent",
+ "oauth_application",
+ "action",
+ "request_id",
+ "marketplace_listing",
+ "user_id",
+ "secondary_category",
+ "oauth_application_id",
+ "actor",
+ "actor_id",
+ "operation_type",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "marketplace_listing.delist",
+ "description": "A listing was removed from GitHub Marketplace.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org_id",
+ "created_at",
+ "secondary_category",
+ "operation_type",
+ "marketplace_listing",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "primary_category",
+ "integration"
+ ]
+ },
+ {
+ "action": "marketplace_listing.redraft",
+ "description": "A listing was sent back to draft state.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "secondary_category",
+ "oauth_application_id",
+ "@timestamp",
+ "action",
+ "user_agent",
+ "user_id",
+ "operation_type",
+ "oauth_application",
+ "actor",
+ "created_at",
+ "marketplace_listing",
+ "request_id",
+ "actor_id",
+ "primary_category",
+ "user"
+ ]
+ },
+ {
+ "action": "marketplace_listing.reject",
+ "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "primary_category",
+ "secondary_category",
+ "marketplace_listing",
+ "oauth_application",
+ "oauth_application_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "members_can_create_pages.disable",
+ "description": "The ability for members to publish GitHub Pages sites was disabled.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
+ },
+ {
+ "action": "members_can_create_pages.enable",
+ "description": "The ability for members to publish GitHub Pages sites was enabled.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
+ },
+ {
+ "action": "members_can_create_private_pages.disable",
+ "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
+ },
+ {
+ "action": "members_can_create_private_pages.enable",
+ "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
+ },
+ {
+ "action": "members_can_create_public_pages.disable",
+ "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
+ },
+ {
+ "action": "members_can_create_public_pages.enable",
+ "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
+ },
+ {
+ "action": "members_can_delete_repos.clear",
+ "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
+ "fields": [
+ "_document_id",
+ "request_id",
+ "user",
+ "user_id",
+ "business",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "business_id",
+ "@timestamp",
+ "created_at",
+ "action"
+ ],
+ "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+ },
+ {
+ "action": "members_can_delete_repos.disable",
+ "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
+ "fields": [
+ "request_id",
+ "org",
+ "_document_id",
+ "actor_id",
+ "user",
+ "user_id",
+ "user_agent",
+ "actor",
+ "operation_type",
+ "org_id",
+ "action",
+ "@timestamp",
+ "created_at"
+ ],
+ "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+ },
+ {
+ "action": "members_can_delete_repos.enable",
+ "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
+ "fields": [
+ "action",
+ "org_id",
+ "user_id",
+ "business",
+ "actor_id",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "user",
+ "business_id",
+ "created_at",
+ "actor",
+ "org",
+ "operation_type",
+ "user_agent"
+ ],
+ "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+ },
+ {
+ "action": "members_can_view_dependency_insights.clear",
+ "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "created_at",
+ "request_id",
+ "actor",
+ "action",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "members_can_view_dependency_insights.disable",
+ "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
+ "fields": [
+ "business",
+ "created_at",
+ "user_id",
+ "business_id",
+ "user",
+ "org",
+ "operation_type",
+ "request_id",
+ "actor",
+ "_document_id",
+ "action",
+ "user_agent",
+ "actor_id",
+ "org_id",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
+ },
+ {
+ "action": "members_can_view_dependency_insights.enable",
+ "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
+ "fields": [
+ "request_id",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "operation_type",
+ "@timestamp",
+ "action",
+ "actor",
+ "actor_id"
+ ],
+ "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
+ },
+ {
+ "action": "merge_queue.pull_request_dequeued",
+ "description": "A pull request was removed from a merge queue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "public_repo",
+ "repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "merge_queue.pull_request_queue_jump",
+ "description": "A pull request was moved ahead in a merge queue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo_id",
+ "public_repo",
+ "repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "merge_queue.queue_cleared",
+ "description": "A merge queue was cleared.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "public_repo",
+ "repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "merge_queue.update_settings",
+ "description": "The settings for a merge queue were updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "max_entries_to_build",
+ "min_entries_to_merge",
+ "repo_id",
+ "public_repo",
+ "repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "metered_billing_configuration.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "@timestamp",
+ "_document_id",
+ "user_id",
+ "action",
+ "operation_type",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "metered_billing_configuration.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "metered_billing_configuration.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "org",
+ "created_at",
+ "operation_type",
+ "org_id",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "actor",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "migration.create",
+ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "org_id",
+ "_document_id",
+ "org",
+ "repo_id",
+ "action",
+ "actor",
+ "created_at",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "migration.destroy_file",
+ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "@timestamp",
+ "org_id",
+ "action",
+ "operation_type",
+ "created_at",
+ "repo",
+ "_document_id",
+ "repo_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "migration.download",
+ "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "org_id",
+ "request_id",
+ "oauth_application_id",
+ "repo_id",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "created_at",
+ "org",
+ "action",
+ "_document_id",
+ "repo",
+ "actor",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "network_configuration.create",
+ "description": "A network configuration for a hosted compute service was created.",
+ "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "selected_service",
+ "network_settings_ids",
+ "previous_settings_ids",
+ "network_configuration_id",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
+ ],
+ "docs_reference_titles": "About networking for hosted compute products in your enterprise"
+ },
+ {
+ "action": "network_configuration.delete",
+ "description": "A network configuration for a hosted compute service was deleted.",
+ "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "network_configuration_id"
+ ],
+ "docs_reference_titles": "About networking for hosted compute products in your enterprise"
+ },
+ {
+ "action": "network_configuration.update",
+ "description": "A network configuration for a hosted compute service was updated.",
+ "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "selected_service",
+ "network_settings_ids",
+ "previous_settings_ids",
+ "failover_network_settings_ids",
+ "failover_network_enabled"
+ ],
+ "docs_reference_titles": "About networking for hosted compute products in your enterprise"
+ },
+ {
+ "action": "oauth_application.create",
+ "description": "An OAuth application was created.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "org",
+ "created_at",
+ "oauth_application_id",
+ "operation_type",
+ "user_agent",
+ "actor_id",
+ "org_id",
+ "action",
+ "actor",
+ "oauth_application",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.destroy",
+ "description": "An OAuth application was deleted.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "created_at",
+ "oauth_application_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "oauth_application",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "request_id",
+ "action",
+ "user",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.generate_client_secret",
+ "description": "An OAuth application's secret key was generated.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application",
+ "oauth_application_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.remove_client_secret",
+ "description": "An OAuth application's secret key was deleted.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application",
+ "oauth_application_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.reset_secret",
+ "description": "The secret key for an OAuth application was reset.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "user",
+ "user_id",
+ "action",
+ "oauth_application",
+ "operation_type",
+ "request_id",
+ "actor_id",
+ "_document_id",
+ "created_at",
+ "actor",
+ "oauth_application_id",
+ "@timestamp",
+ "user_agent"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.revoke_all_tokens",
+ "description": "All user tokens for an OAuth application were requested to be revoked.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application",
+ "oauth_application_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.revoke_tokens",
+ "description": "Token(s) for an OAuth application were revoked.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "oauth_application_id",
+ "oauth_application",
+ "actor_id",
+ "user_agent",
+ "@timestamp",
+ "request_id",
+ "user_id",
+ "action",
+ "_document_id",
+ "actor",
+ "user",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.transfer",
+ "description": "An OAuth application was transferred from one account to another.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "actor",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "oauth_application",
+ "actor_id",
+ "oauth_application_id",
+ "@timestamp",
+ "user_id",
+ "_document_id",
+ "request_id",
+ "user",
+ "action"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "org.accept_business_invitation",
+ "description": "An invitation sent to an organization to join an enterprise was accepted.",
+ "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Adding organizations to your enterprise"
+ },
+ {
+ "action": "org.add_billing_manager",
+ "description": "A billing manager was added to an organization.",
+ "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
+ "fields": [
+ "operation_type",
+ "_document_id",
+ "user_agent",
+ "org",
+ "user_id",
+ "action",
+ "created_at",
+ "org_id",
+ "user",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "request_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
+ },
+ {
+ "action": "org.add_disallowed_two_factor_method",
+ "description": "An organization prevented access to resources by users with the given two-factor method.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "two_factor_method",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "org.add_member",
+ "description": "A user joined an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "permission",
+ "_document_id",
+ "org",
+ "operation_type",
+ "request_id",
+ "actor",
+ "user",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "org_id",
+ "user_id",
+ "actor_id",
+ "action",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "org.add_outside_collaborator",
+ "description": "An outside collaborator was added to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "inviter",
+ "org",
+ "org_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "permission",
+ "invitee",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.add_security_manager",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org_id",
+ "org",
+ "team",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "org.advanced_security_disabled_for_new_repos",
+ "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org.advanced_security_disabled_on_all_repos",
+ "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org.advanced_security_enabled_for_new_repos",
+ "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org.advanced_security_enabled_on_all_repos",
+ "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org.advanced_security_entity_policy_update",
+ "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "new_policy",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
+ },
+ {
+ "action": "org.advanced_security_policy_selected_member_disabled",
+ "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
+ },
+ {
+ "action": "org.advanced_security_policy_selected_member_enabled",
+ "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
+ },
+ {
+ "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled",
+ "description": "Third-party application access for outside collaborators was disabled for the organization.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Limiting OAuth app and GitHub App access requests and installations"
+ },
+ {
+ "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
+ "description": "Third-party application access for outside collaborators was enabled for the organization.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests"
+ },
+ {
+ "action": "org.archive",
+ "description": "The organization was archived.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.audit_log_export",
+ "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log",
+ "fields": [
+ "org_id",
+ "operation_type",
+ "@timestamp",
+ "request_id",
+ "_document_id",
+ "actor",
+ "org",
+ "action",
+ "created_at",
+ "user_agent",
+ "actor_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
+ },
+ {
+ "action": "org.audit_log_git_event_export",
+ "description": "An export of the organization's Git events was created.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "start",
+ "end",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
+ },
+ {
+ "action": "org.billing_signup_error",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "request_id",
+ "user_agent",
+ "action",
+ "@timestamp",
+ "actor_id",
+ "org_id",
+ "_document_id",
+ "actor",
+ "org",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.block_user",
+ "description": "An organization owner blocked a user from accessing the organization's repositories.",
+ "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
+ "fields": [
+ "actor",
+ "user_agent",
+ "org_id",
+ "created_at",
+ "_document_id",
+ "blocked_user",
+ "action",
+ "operation_type",
+ "actor_id",
+ "org",
+ "@timestamp",
+ "request_id"
+ ],
+ "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
+ },
+ {
+ "action": "org.cancel_business_invitation",
+ "description": "An invitation for an organization to join an enterprise was revoked",
+ "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "initiated_from"
+ ],
+ "docs_reference_titles": "Adding organizations to your enterprise"
+ },
+ {
+ "action": "org.cancel_invitation",
+ "description": "An invitation sent to a user to join an organization was revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "org_id",
+ "request_id",
+ "email",
+ "@timestamp",
+ "actor",
+ "action",
+ "operation_type",
+ "user_agent",
+ "org",
+ "invitation_id",
+ "_document_id",
+ "created_at",
+ "invitee_email",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "org.clear_custom_invitation_rate_limit",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "org.clear_disallowed_two_factor_methods",
+ "description": "Cleared two-factor authentication restrictions for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "org.code_scanning_autofix_disabled",
+ "description": "Autofix for code scanning alerts was disabled for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.code_scanning_autofix_enabled",
+ "description": "Autofix for code scanning alerts was enabled for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.code_scanning_autofix_third_party_tools_disabled",
+ "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.code_scanning_autofix_third_party_tools_enabled",
+ "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.code_security_metered_usage_lock",
+ "description": "Enablement for Code Security features on new repositories has been locked for this organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.code_security_metered_usage_unlock",
+ "description": "Enablement for Code Security features on new repositories has been unlocked for this organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.codeql_disabled",
+ "description": "Code scanning using the default setup was disabled for an organization.",
+ "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
+ },
+ {
+ "action": "org.codeql_enabled",
+ "description": "Code scanning using the default setup was enabled for an organization.",
+ "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Configuring default setup for code scanning at scale"
+ },
+ {
+ "action": "org.codespaces_access_updated",
+ "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
+ "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "enablement",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
+ },
+ {
+ "action": "org.codespaces_ownership_updated",
+ "description": "Ownership and payment for codespaces was updated for an organization.",
+ "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "owner_type",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
+ },
+ {
+ "action": "org.codespaces_team_access_allowed",
+ "description": "A team has been allowed to use Codespaces for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "team",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.codespaces_team_access_revoked",
+ "description": "A team has been prevented from using Codespaces for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "team",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.codespaces_trusted_repo_access_granted",
+ "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
+ "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing access to other repositories within your codespace"
+ },
+ {
+ "action": "org.codespaces_trusted_repo_access_revoked",
+ "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
+ "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Managing access to other repositories within your codespace"
+ },
+ {
+ "action": "org.codespaces_user_access_allowed",
+ "description": "A user has been allowed to use Codespaces for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "org.codespaces_user_access_revoked",
+ "description": "A user has been prevented from using Codespaces for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "org.config.disable_collaborators_only",
+ "description": "The interaction limit for collaborators only for an organization was disabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
+ "fields": [
+ "request_id",
+ "org",
+ "action",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "user_agent",
+ "org_id",
+ "created_at"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
+ },
+ {
+ "action": "org.config.disable_contributors_only",
+ "description": "The interaction limit for prior contributors only for an organization was disabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
+ "fields": [
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "action",
+ "actor_id",
+ "org",
+ "_document_id",
+ "actor",
+ "org_id",
+ "request_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
+ },
+ {
+ "action": "org.config.disable_sockpuppet_disallowed",
+ "description": "The interaction limit for existing users only for an organization was disabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
+ "fields": [
+ "_document_id",
+ "operation_type",
+ "actor_id",
+ "org_id",
+ "action",
+ "created_at",
+ "actor",
+ "org",
+ "@timestamp",
+ "user_agent",
+ "request_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
+ },
+ {
+ "action": "org.config.enable_collaborators_only",
+ "description": "The interaction limit for collaborators only for an organization was enabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
+ "fields": [
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "actor_id",
+ "actor",
+ "org",
+ "org_id",
+ "request_id",
+ "operation_type",
+ "action",
+ "user_agent"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
+ },
+ {
+ "action": "org.config.enable_contributors_only",
+ "description": "The interaction limit for prior contributors only for an organization was enabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "org",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
+ },
+ {
+ "action": "org.config.enable_sockpuppet_disallowed",
+ "description": "The interaction limit for existing users only for an organization was enabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
+ "fields": [
+ "actor_id",
+ "request_id",
+ "action",
+ "created_at",
+ "user_agent",
+ "actor",
+ "_document_id",
+ "org_id",
+ "operation_type",
+ "org",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
+ },
+ {
+ "action": "org.configure_self_hosted_jit_runner",
+ "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
+ "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
+ },
+ {
+ "action": "org.confirm_business_invitation",
+ "description": "An invitation for an organization to join an enterprise was confirmed.",
+ "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Adding organizations to your enterprise"
+ },
+ {
+ "action": "org.connect_usage_metrics_export",
+ "description": "Server statistics were exported for the organization.",
+ "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Exporting Server Statistics"
+ },
+ {
+ "action": "org.create",
+ "description": "An organization was created.",
+ "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
+ "fields": [
+ "request_id",
+ "org",
+ "actor_id",
+ "actor",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "operation_type",
+ "org_id",
+ "created_at",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
+ },
+ {
+ "action": "org.create_actions_secret",
+ "description": "A GitHub Actions secret was created for an organization.",
+ "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Using secrets in GitHub Actions"
+ },
+ {
+ "action": "org.create_actions_variable",
+ "description": "A GitHub Actions variable was created for an organization.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "org.create_integration_secret",
+ "description": "A Codespaces or Dependabot secret was created for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "visibility",
+ "integration",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org_credential_authorization.deauthorize",
+ "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
+ "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "org_id",
+ "business",
+ "action",
+ "@timestamp",
+ "org",
+ "_document_id",
+ "business_id",
+ "actor",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "oauth_credential_type",
+ "managed_oauth_access_id",
+ "managed_token_id",
+ "managed_oauth_scopes",
+ "managed_token_scopes",
+ "managed_hashed_token"
+ ],
+ "docs_reference_titles": "Authorizing a personal access token for use with single sign-on"
+ },
+ {
+ "action": "org_credential_authorization.grant",
+ "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
+ "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on",
+ "fields": [
+ "user_agent",
+ "actor",
+ "@timestamp",
+ "created_at",
+ "org_id",
+ "business_id",
+ "operation_type",
+ "request_id",
+ "_document_id",
+ "action",
+ "actor_id",
+ "business",
+ "org",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "oauth_credential_type",
+ "request_access_security_header",
+ "managed_oauth_access_id",
+ "managed_token_id",
+ "managed_oauth_scopes",
+ "managed_token_scopes",
+ "managed_hashed_token"
+ ],
+ "docs_reference_titles": "Authenticating with single sign-on"
+ },
+ {
+ "action": "org_credential_authorization.revoke",
+ "description": "An owner revoked authorized credentials.",
+ "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization",
+ "fields": [
+ "actor",
+ "org",
+ "@timestamp",
+ "owner",
+ "oauth_application_id",
+ "org_id",
+ "operation_type",
+ "action",
+ "business",
+ "request_id",
+ "created_at",
+ "business_id",
+ "actor_id",
+ "_document_id",
+ "user_agent",
+ "oauth_credential_type",
+ "managed_oauth_access_id",
+ "managed_token_id",
+ "managed_oauth_scopes",
+ "managed_token_scopes",
+ "managed_hashed_token"
+ ],
+ "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
+ },
+ {
+ "action": "org.delete",
+ "description": "An organization was deleted by a user or staff.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "@timestamp",
+ "_document_id",
+ "created_at",
+ "actor",
+ "org_id",
+ "org",
+ "action",
+ "actor_id",
+ "operation_type",
+ "request_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.disable_member_team_creation_permission",
+ "description": "Team creation was limited to owners.",
+ "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
+ "fields": [
+ "actor",
+ "@timestamp",
+ "_document_id",
+ "user",
+ "user_id",
+ "action",
+ "created_at",
+ "actor_id",
+ "user_agent",
+ "org",
+ "org_id",
+ "operation_type",
+ "request_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
+ },
+ {
+ "action": "org.disable_oauth_app_restrictions",
+ "description": "Third-party application access restrictions for an organization were disabled.",
+ "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
+ "fields": [
+ "actor_id",
+ "org_id",
+ "action",
+ "_document_id",
+ "request_id",
+ "@timestamp",
+ "actor",
+ "org",
+ "operation_type",
+ "user_agent",
+ "created_at"
+ ],
+ "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
+ },
+ {
+ "action": "org.disable_reader_discussion_creation_permission",
+ "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
+ },
+ {
+ "action": "org.disable_saml",
+ "description": "SAML single sign-on was disabled for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "sso_url",
+ "issuer",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "created_at",
+ "org",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.disable_source_ip_disclosure",
+ "description": "Display of IP addresses within audit log events for the organization was disabled.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
+ },
+ {
+ "action": "org.disable_two_factor_requirement",
+ "description": "A two-factor authentication requirement was disabled for the organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "org",
+ "org_id",
+ "action",
+ "actor",
+ "actor_id",
+ "operation_type",
+ "request_id",
+ "@timestamp",
+ "_document_id",
+ "user_agent"
+ ]
+ },
+ {
+ "action": "org.display_commenter_full_name_disabled",
+ "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "user_id",
+ "user",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "created_at",
+ "user_agent",
+ "org",
+ "actor_id",
+ "org_id",
+ "request_id"
+ ]
+ },
+ {
+ "action": "org.display_commenter_full_name_enabled",
+ "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "user_agent",
+ "request_id",
+ "actor",
+ "_document_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "user",
+ "action",
+ "actor_id",
+ "org_id"
+ ]
+ },
+ {
+ "action": "org.enable_member_team_creation_permission",
+ "description": "Team creation by members was allowed.",
+ "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
+ "fields": [
+ "org_id",
+ "user",
+ "actor",
+ "operation_type",
+ "_document_id",
+ "user_id",
+ "created_at",
+ "user_agent",
+ "actor_id",
+ "org",
+ "request_id",
+ "action",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
+ },
+ {
+ "action": "org.enable_oauth_app_restrictions",
+ "description": "Third-party application access restrictions for an organization were enabled.",
+ "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization",
+ "fields": [
+ "actor_id",
+ "operation_type",
+ "org",
+ "created_at",
+ "_document_id",
+ "actor",
+ "org_id",
+ "action",
+ "user_agent",
+ "request_id",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
+ },
+ {
+ "action": "org.enable_reader_discussion_creation_permission",
+ "description": "An organization owner allowed users with read access to create discussions in an organization",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
+ },
+ {
+ "action": "org.enable_saml",
+ "description": "SAML single sign-on was enabled for the organization.",
+ "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
+ "fields": [
+ "actor_id",
+ "action",
+ "operation_type",
+ "actor",
+ "sso_url",
+ "org",
+ "created_at",
+ "@timestamp",
+ "issuer",
+ "org_id",
+ "_document_id",
+ "user_agent",
+ "request_id"
+ ],
+ "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
+ },
+ {
+ "action": "org.enable_source_ip_disclosure",
+ "description": "Display of IP addresses within audit log events for the organization was enabled.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
+ },
+ {
+ "action": "org.enable_two_factor_requirement",
+ "description": "Two-factor authentication is now required for the organization.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
+ "fields": [
+ "actor_id",
+ "action",
+ "_document_id",
+ "org",
+ "@timestamp",
+ "actor",
+ "user_agent",
+ "org_id",
+ "operation_type",
+ "created_at",
+ "request_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
+ },
+ {
+ "action": "org.integration_manager_added",
+ "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "org_id",
+ "manager",
+ "@timestamp",
+ "request_id",
+ "actor",
+ "operation_type",
+ "_document_id",
+ "actor_id",
+ "org",
+ "action",
+ "created_at"
+ ]
+ },
+ {
+ "action": "org.integration_manager_removed",
+ "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "@timestamp",
+ "org",
+ "user_agent",
+ "request_id",
+ "action",
+ "actor",
+ "actor_id",
+ "manager",
+ "operation_type",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "org.invite_member",
+ "description": "A new user was invited to join an organization.",
+ "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
+ "fields": [
+ "org",
+ "user_id",
+ "invitation_id",
+ "org_id",
+ "user",
+ "action",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "actor_id",
+ "request_id",
+ "invitee_email",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
+ },
+ {
+ "action": "org.invite_to_business",
+ "description": "An organization was invited to join an enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.members_can_update_protected_branches.disable",
+ "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "org.members_can_update_protected_branches.enable",
+ "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "org_id",
+ "user_agent",
+ "actor_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "request_id",
+ "_document_id",
+ "actor",
+ "user",
+ "action"
+ ]
+ },
+ {
+ "action": "org.oauth_app_access_approved",
+ "description": "Access to an organization was granted for an OAuth App.",
+ "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization",
+ "fields": [
+ "url",
+ "actor",
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "operation_type",
+ "org_id",
+ "_document_id",
+ "org",
+ "action",
+ "created_at",
+ "@timestamp",
+ "request_access_security_header",
+ "oauth_application_name"
+ ],
+ "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
+ },
+ {
+ "action": "org.oauth_app_access_blocked",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "url",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "oauth_application_name"
+ ]
+ },
+ {
+ "action": "org.oauth_app_access_denied",
+ "description": "Access was disabled for an OAuth App that was previously approved.",
+ "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization",
+ "fields": [
+ "request_id",
+ "url",
+ "created_at",
+ "org_id",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "org",
+ "operation_type",
+ "actor",
+ "actor_id",
+ "oauth_application_name"
+ ],
+ "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
+ },
+ {
+ "action": "org.oauth_app_access_requested",
+ "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "actor_id",
+ "_document_id",
+ "request_id",
+ "url",
+ "org_id",
+ "action",
+ "@timestamp",
+ "org",
+ "request_access_security_header",
+ "oauth_application_name"
+ ]
+ },
+ {
+ "action": "org.oauth_app_access_unblocked",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "url",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "oauth_application_name"
+ ]
+ },
+ {
+ "action": "org.rate_limited_invites",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "created_at",
+ "request_id",
+ "org_id",
+ "action",
+ "actor",
+ "actor_id",
+ "user_agent",
+ "operation_type",
+ "_document_id",
+ "org"
+ ]
+ },
+ {
+ "action": "org.recovery_code_failed",
+ "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.",
+ "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "reason",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
+ },
+ {
+ "action": "org.recovery_code_used",
+ "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.",
+ "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
+ },
+ {
+ "action": "org.recovery_codes_downloaded",
+ "description": "An organization owner downloaded the organization's SSO recovery codes.",
+ "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
+ },
+ {
+ "action": "org.recovery_codes_generated",
+ "description": "An organization owner generated the organization's SSO recovery codes.",
+ "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
+ },
+ {
+ "action": "org.recovery_codes_printed",
+ "description": "An organization owner printed the organization's SSO recovery codes.",
+ "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
+ },
+ {
+ "action": "org.recovery_codes_viewed",
+ "description": "An organization owner viewed the organization's SSO recovery codes.",
+ "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
+ },
+ {
+ "action": "org.register_self_hosted_runner",
+ "description": "A new self-hosted runner was registered.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
+ "fields": [
+ "actor",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "created_at",
+ "user_agent",
+ "actor_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Adding self-hosted runners"
+ },
+ {
+ "action": "org.remove_actions_secret",
+ "description": "A GitHub Actions secret was removed from an organization.",
+ "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Using secrets in GitHub Actions"
+ },
+ {
+ "action": "org.remove_actions_variable",
+ "description": "A GitHub Actions variable was removed from an organization.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "org.remove_billing_manager",
+ "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
+ "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
+ "fields": [
+ "user_id",
+ "user_agent",
+ "org_id",
+ "user",
+ "action",
+ "_document_id",
+ "operation_type",
+ "@timestamp",
+ "actor",
+ "org",
+ "actor_id",
+ "request_id",
+ "created_at"
+ ],
+ "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
+ },
+ {
+ "action": "org.remove_disallowed_two_factor_method",
+ "description": "Removed a two-factor authentication method restriction for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "two_factor_method",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "org.remove_integration_secret",
+ "description": "A Codespaces or Dependabot secret was removed from an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "integration",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org.remove_member",
+ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "request_id",
+ "actor_id",
+ "user_agent",
+ "actor",
+ "action",
+ "user_id",
+ "@timestamp",
+ "created_at",
+ "user",
+ "operation_type",
+ "org_id",
+ "org",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "org.remove_outside_collaborator",
+ "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "user",
+ "org_id",
+ "created_at",
+ "request_id",
+ "@timestamp",
+ "action",
+ "operation_type",
+ "user_agent",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "user_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.remove_security_manager",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org_id",
+ "org",
+ "team",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "org.remove_self_hosted_runner",
+ "description": "A self-hosted runner was removed.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
+ "fields": [
+ "operation_type",
+ "org_id",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "org",
+ "created_at",
+ "actor",
+ "action",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Removing self-hosted runners"
+ },
+ {
+ "action": "org.rename",
+ "description": "An organization was renamed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "_document_id",
+ "@timestamp",
+ "org",
+ "action",
+ "actor",
+ "old_login",
+ "org_id",
+ "request_id",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.required_workflow_create",
+ "description": "Triggered when a required workflow is created.",
+ "docs_reference_links": "/actions/using-workflows/required-workflows",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/actions/using-workflows/required-workflows"
+ },
+ {
+ "action": "org.required_workflow_delete",
+ "description": "Triggered when a required workflow is deleted.",
+ "docs_reference_links": "/actions/using-workflows/required-workflows",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/actions/using-workflows/required-workflows"
+ },
+ {
+ "action": "org.required_workflow_update",
+ "description": "Triggered when a required workflow is updated.",
+ "docs_reference_links": "/actions/using-workflows/required-workflows",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/actions/using-workflows/required-workflows"
+ },
+ {
+ "action": "org.restore_member",
+ "description": "An organization member was restored.",
+ "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
+ "fields": [
+ "user",
+ "actor",
+ "user_id",
+ "_document_id",
+ "action",
+ "created_at",
+ "org_id",
+ "operation_type",
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "org",
+ "actor_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
+ },
+ {
+ "action": "org.revoke_external_identity",
+ "description": "A member's linked identity was revoked.",
+ "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
+ "fields": [
+ "actor",
+ "org",
+ "org_id",
+ "user",
+ "operation_type",
+ "user_id",
+ "@timestamp",
+ "action",
+ "actor_id",
+ "user_agent",
+ "_document_id",
+ "request_id",
+ "created_at"
+ ],
+ "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
+ },
+ {
+ "action": "org.revoke_sso_session",
+ "description": "A member's SAML session was revoked.",
+ "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
+ "fields": [
+ "actor_id",
+ "created_at",
+ "user",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "org",
+ "org_id",
+ "user_agent",
+ "request_id",
+ "actor",
+ "user_id",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
+ },
+ {
+ "action": "org.runner_group_created",
+ "description": "A self-hosted runner group was created.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "runner_group_restricted_to_workflows",
+ "runner_group_selected_workflow_refs",
+ "programmatic_access_type",
+ "network_configuration_id"
+ ],
+ "docs_reference_titles": "Managing access to self-hosted runners using groups"
+ },
+ {
+ "action": "org.runner_group_removed",
+ "description": "A self-hosted runner group was removed.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Managing access to self-hosted runners using groups"
+ },
+ {
+ "action": "org.runner_group_renamed",
+ "description": "A self-hosted runner group was renamed.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Managing access to self-hosted runners using groups"
+ },
+ {
+ "action": "org.runner_group_runner_removed",
+ "description": "The REST API was used to remove a self-hosted runner from a group.",
+ "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "runner_group_id",
+ "runner_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
+ },
+ {
+ "action": "org.runner_group_runners_added",
+ "description": "A self-hosted runner was added to a group.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing access to self-hosted runners using groups"
+ },
+ {
+ "action": "org.runner_group_runners_updated",
+ "description": "A runner group's list of members was updated.",
+ "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "runner_group_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
+ },
+ {
+ "action": "org.runner_group_updated",
+ "description": "The configuration of a self-hosted runner group was changed.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "runner_group_name",
+ "runner_group_allow_public",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "runner_group_restricted_to_workflows",
+ "runner_group_selected_workflow_refs",
+ "programmatic_access_type",
+ "network_configuration_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing access to self-hosted runners using groups"
+ },
+ {
+ "action": "org.runner_group_visiblity_updated",
+ "description": "The visibility of a self-hosted runner group was updated via the REST API.",
+ "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "runner_group_id",
+ "visibility",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
+ },
+ {
+ "action": "org.secret_protection_metered_usage_lock",
+ "description": "Enablement for Secret Protection features on new repositories has been locked for this organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.secret_protection_metered_usage_unlock",
+ "description": "Enablement for Secret Protection features on new repositories has been unlocked for this organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org_secret_scanning_automatic_validity_checks.disabled",
+ "description": "Automatic partner validation checks have been disabled at the organization level",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
+ },
+ {
+ "action": "org_secret_scanning_automatic_validity_checks.enabled",
+ "description": "Automatic partner validation checks have been enabled at the organization level",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
+ },
+ {
+ "action": "org_secret_scanning_custom_pattern.create",
+ "description": "A custom pattern was created for secret scanning in an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "org_secret_scanning_custom_pattern.delete",
+ "description": "A custom pattern was removed from secret scanning in an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "org_secret_scanning_custom_pattern.publish",
+ "description": "A custom pattern was published for secret scanning in an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "org.secret_scanning_custom_pattern_push_protection_disabled",
+ "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "org.secret_scanning_custom_pattern_push_protection_enabled",
+ "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "org_secret_scanning_custom_pattern.update",
+ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "org_secret_scanning_generic_secrets.disabled",
+ "description": "Generic secrets have been disabled at the organization level",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org_secret_scanning_generic_secrets.enabled",
+ "description": "Generic secrets have been enabled at the organization level",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org_secret_scanning_non_provider_patterns.disabled",
+ "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
+ "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Supported secret scanning patterns"
+ },
+ {
+ "action": "org_secret_scanning_non_provider_patterns.enabled",
+ "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
+ "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Supported secret scanning patterns"
+ },
+ {
+ "action": "org_secret_scanning_push_protection_bypass_list.add",
+ "description": "A role or team was added to the push protection bypass list at the organization level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org_secret_scanning_push_protection_bypass_list.disable",
+ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org_secret_scanning_push_protection_bypass_list.enable",
+ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org_secret_scanning_push_protection_bypass_list.remove",
+ "description": "A role or team was removed from the push protection bypass list at the organization level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_custom_message_disabled",
+ "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_custom_message_enabled",
+ "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_custom_message_updated",
+ "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_disable",
+ "description": "Push protection for secret scanning was disabled.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_enable",
+ "description": "Push protection for secret scanning was enabled.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_new_repos_disable",
+ "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.secret_scanning_push_protection_new_repos_enable",
+ "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
+ "description": "The push protection setting was updated for a secret type for your organization.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
+ "fields": [
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "push_protection_setting",
+ "secret_type",
+ "secret_type_display_name",
+ "created_at"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org_secret_scanning_push_protection_pattern_configuration.updated",
+ "description": "The push protection pattern configuration was updated for your organization.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
+ "fields": [
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "created_at"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "org.security_center_export_code_scanning_metrics",
+ "description": "A CSV export was requested on the CodeQL pull request alerts page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "start_date",
+ "end_date",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "org.security_center_export_coverage",
+ "description": "A CSV export was requested on the Coverage page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.security_center_export_overview_dashboard",
+ "description": "A CSV export was requested on the Overview Dashboard page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "start_date",
+ "end_date",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.security_center_export_risk",
+ "description": "A CSV export was requested on the Risk page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.self_hosted_runner_offline",
+ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
+ "fields": [
+ "org_id",
+ "org",
+ "runner_id",
+ "runner_name",
+ "action",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+ },
+ {
+ "action": "org.self_hosted_runner_online",
+ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
+ "fields": [
+ "org_id",
+ "org",
+ "runner_id",
+ "runner_name",
+ "action",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+ },
+ {
+ "action": "org.self_hosted_runner_updated",
+ "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
+ "fields": [
+ "org_id",
+ "runner_id",
+ "runner_name",
+ "source_version",
+ "target_version",
+ "runner_group_id",
+ "runner_group_name"
+ ],
+ "docs_reference_titles": "Self-hosted runners"
+ },
+ {
+ "action": "org.set_actions_cache_retention_policy",
+ "description": "The cache retention policy for GitHub Actions was set for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization"
+ },
+ {
+ "action": "org.set_actions_cache_storage_policy",
+ "description": "The cache storage policy for GitHub Actions was set for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization"
+ },
+ {
+ "action": "org.set_actions_fork_pr_approvals_policy",
+ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "policy",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
+ },
+ {
+ "action": "org.set_actions_private_fork_pr_approvals_policy",
+ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "policy",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
+ },
+ {
+ "action": "org.set_actions_retention_limit",
+ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
+ "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "limit",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
+ },
+ {
+ "action": "org.set_custom_invitation_rate_limit",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "_document_id",
+ "org_id",
+ "operation_type",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "request_id",
+ "created_at",
+ "org",
+ "action"
+ ]
+ },
+ {
+ "action": "org.set_default_workflow_permissions",
+ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
+ },
+ {
+ "action": "org.set_fork_pr_workflows_policy",
+ "description": "The policy for workflows on private repository forks was changed.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "policy",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
+ },
+ {
+ "action": "org.set_workflow_permission_can_approve_pr",
+ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
+ },
+ {
+ "action": "org.sso_response",
+ "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "org_id",
+ "@timestamp",
+ "org",
+ "issuer",
+ "business",
+ "operation_type",
+ "created_at",
+ "request_id",
+ "business_id",
+ "_document_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.transfer",
+ "description": "An organization was transferred between enterprise accounts.",
+ "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "from_business",
+ "to_business",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Adding organizations to your enterprise"
+ },
+ {
+ "action": "org.transfer_outgoing",
+ "description": "An organization was transferred between enterprise accounts.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "from_business",
+ "to_business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Adding organizations to your enterprise"
+ },
+ {
+ "action": "org.unarchive",
+ "description": "The organization was unarchived.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.unblock_user",
+ "description": "A user was unblocked from an organization.",
+ "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
+ "fields": [
+ "oauth_application_id",
+ "_document_id",
+ "blocked_user",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "request_id",
+ "created_at",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "user_agent"
+ ],
+ "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
+ },
+ {
+ "action": "org.update_actions_secret",
+ "description": "A GitHub Actions secret was updated for an organization.",
+ "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "created_at",
+ "key",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Using secrets in GitHub Actions"
+ },
+ {
+ "action": "org.update_actions_settings",
+ "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "new_policy",
+ "updated_allowed_types",
+ "old_policy",
+ "updated_access_policy",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
+ },
+ {
+ "action": "org.update_actions_variable",
+ "description": "A GitHub Actions variable was updated for an organization.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "org.update_default_repository_permission",
+ "description": "The default repository permission level for organization members was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "action",
+ "operation_type",
+ "created_at",
+ "org",
+ "org_id",
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "permission",
+ "actor_id",
+ "old_permission",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "org.update_immutable_releases_settings_policy",
+ "description": "The settings policy for immutable releases was updated for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "old_policy",
+ "new_policy",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "org.update_integration_secret",
+ "description": "A Codespaces or Dependabot secret was updated for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "visibility",
+ "integration",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.update_member",
+ "description": "A person's role was changed from owner to member or member to owner.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "org_id",
+ "created_at",
+ "_document_id",
+ "user",
+ "user_id",
+ "action",
+ "request_id",
+ "actor_id",
+ "old_permission",
+ "permission",
+ "actor",
+ "user_agent",
+ "operation_type",
+ "org"
+ ]
+ },
+ {
+ "action": "org.update_member_repository_creation_permission",
+ "description": "The create repository permission for organization members was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "action",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "permission",
+ "created_at",
+ "user_agent",
+ "org",
+ "org_id",
+ "_document_id",
+ "visibility",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.update_member_repository_invitation_permission",
+ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
+ "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
+ "fields": [
+ "actor_id",
+ "permission",
+ "action",
+ "org_id",
+ "actor",
+ "created_at",
+ "_document_id",
+ "business_id",
+ "operation_type",
+ "org",
+ "user_agent",
+ "request_id",
+ "business",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Setting permissions for adding outside collaborators"
+ },
+ {
+ "action": "org.update_new_repository_default_branch_setting",
+ "description": "The name of the default branch was changed for new repositories in the organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
+ },
+ {
+ "action": "org.update_repo_self_hosted_runners_policy",
+ "description": "The repository self-hosted runners policy was updated",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "old_repo_runners_policy",
+ "new_repo_runners_policy",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners"
+ },
+ {
+ "action": "org.update_saml_provider_settings",
+ "description": "An organization's SAML provider settings were updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "sso_url",
+ "actor_id",
+ "operation_type",
+ "@timestamp",
+ "issuer",
+ "org",
+ "_document_id",
+ "actor",
+ "org_id",
+ "created_at",
+ "request_id",
+ "action"
+ ]
+ },
+ {
+ "action": "org.update_terms_of_service",
+ "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
+ "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
+ "fields": [
+ "request_id",
+ "org_id",
+ "actor",
+ "actor_id",
+ "user_agent",
+ "operation_type",
+ "_document_id",
+ "org",
+ "action",
+ "@timestamp",
+ "created_at",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
+ },
+ {
+ "action": "organization_custom_property_value.create",
+ "description": "An organization's custom property value was manually set for the first time.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "definition_id",
+ "property_name",
+ "value",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
+ },
+ {
+ "action": "organization_custom_property_value.destroy",
+ "description": "An organization's custom property value was deleted.",
+ "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "definition_id",
+ "property_name",
+ "value",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
+ },
+ {
+ "action": "organization_default_label.create",
+ "description": "A default label was created for repositories in an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "actor",
+ "org",
+ "org_id",
+ "operation_type",
+ "_document_id",
+ "action",
+ "created_at",
+ "@timestamp",
+ "user_agent",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
+ },
+ {
+ "action": "organization_default_label.destroy",
+ "description": "A default label was deleted for repositories in an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label",
+ "fields": [
+ "operation_type",
+ "request_id",
+ "actor",
+ "@timestamp",
+ "_document_id",
+ "actor_id",
+ "org_id",
+ "org",
+ "action",
+ "created_at",
+ "user_agent"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
+ },
+ {
+ "action": "organization_default_label.update",
+ "description": "A default label was edited for repositories in an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label",
+ "fields": [
+ "org",
+ "created_at",
+ "@timestamp",
+ "actor",
+ "action",
+ "user_agent",
+ "actor_id",
+ "org_id",
+ "operation_type",
+ "request_id",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
+ },
+ {
+ "action": "organization_domain.approve",
+ "description": "A domain was approved for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner_type",
+ "domain_name",
+ "org_id",
+ "business_id",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
+ },
+ {
+ "action": "organization_domain.create",
+ "description": "A domain was added to an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
+ "fields": [
+ "created_at",
+ "_document_id",
+ "domain_name",
+ "action",
+ "request_id",
+ "actor_id",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "actor"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
+ },
+ {
+ "action": "organization_domain.destroy",
+ "description": "A domain was removed from an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
+ "fields": [
+ "action",
+ "domain_name",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "operation_type",
+ "created_at"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain"
+ },
+ {
+ "action": "organization_domain.verify",
+ "description": "A domain was verified for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
+ "fields": [
+ "operation_type",
+ "domain_name",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "actor",
+ "action",
+ "created_at",
+ "_document_id",
+ "actor_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
+ },
+ {
+ "action": "organization_moderators.add_team",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "team",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "organization_moderators.add_user",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "organization_moderators.remove_team",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "team",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "organization_moderators.remove_user",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "organization_projects_change.clear",
+ "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
+ "fields": [
+ "actor",
+ "business_id",
+ "@timestamp",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "user_agent",
+ "_document_id",
+ "created_at",
+ "operation_type",
+ "request_id",
+ "business"
+ ],
+ "docs_reference_titles": "Enforcing policies for projects in your enterprise"
+ },
+ {
+ "action": "organization_projects_change.disable",
+ "description": "Organization projects were disabled for all organizations in an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
+ "fields": [
+ "org_id",
+ "action",
+ "user",
+ "org",
+ "created_at",
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "operation_type",
+ "@timestamp",
+ "actor",
+ "user_id",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Enforcing policies for projects in your enterprise"
+ },
+ {
+ "action": "organization_projects_change.enable",
+ "description": "Organization projects were enabled for all organizations in an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
+ "fields": [
+ "actor_id",
+ "org_id",
+ "created_at",
+ "user_id",
+ "org",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "request_id",
+ "user",
+ "action",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Enforcing policies for projects in your enterprise"
+ },
+ {
+ "action": "organization_role.assign",
+ "description": "An organization role was assigned to a user or team.",
+ "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "organization_role_id",
+ "organization_role_name",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About custom organization roles"
+ },
+ {
+ "action": "organization_role.create",
+ "description": "A custom organization role was created in an organization.",
+ "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "name",
+ "owner",
+ "role_permissions",
+ "base_role",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "About custom organization roles"
+ },
+ {
+ "action": "organization_role.destroy",
+ "description": "A custom organization role was deleted in an organization.",
+ "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "name",
+ "owner",
+ "role_permissions",
+ "base_role",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "About custom organization roles"
+ },
+ {
+ "action": "organization_role.revoke",
+ "description": "A user or team was unassigned an organization role.",
+ "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "organization_role_id",
+ "organization_role_name",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "About custom organization roles"
+ },
+ {
+ "action": "organization_role.update",
+ "description": "A custom organization role was edited in an organization.",
+ "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "name",
+ "owner",
+ "role_permissions",
+ "base_role",
+ "old_role_permissions",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "old_base_role"
+ ],
+ "docs_reference_titles": "About custom organization roles"
+ },
+ {
+ "action": "organization_wide_project_base_role.update",
+ "description": "An organization's default project base role was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "old_project_base_role",
+ "new_project_base_role",
+ "business",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "packages.package_deleted",
+ "description": "An entire package was deleted.",
+ "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
+ "fields": [
+ "actor_id",
+ "actor",
+ "org",
+ "org_id",
+ "repo",
+ "repo_id",
+ "package",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
+ },
+ {
+ "action": "packages.package_published",
+ "description": "A package was published or republished to an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "actor",
+ "org",
+ "org_id",
+ "repo",
+ "repo_id",
+ "package",
+ "ecosystem",
+ "version_count",
+ "is_republished",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "packages.package_version_deleted",
+ "description": "A specific package version was deleted.",
+ "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
+ "fields": [
+ "actor_id",
+ "actor",
+ "org",
+ "org_id",
+ "repo",
+ "repo_id",
+ "package",
+ "version",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "ecosystem",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
+ },
+ {
+ "action": "packages.package_version_published",
+ "description": "A specific package version was published or republished to a package.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "ecosystem",
+ "package",
+ "version",
+ "actor_id",
+ "user_agent",
+ "is_republished",
+ "actor",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "pages_protected_domain.create",
+ "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
+ "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "owner_type",
+ "domain",
+ "state",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
+ },
+ {
+ "action": "pages_protected_domain.delete",
+ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
+ "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "owner_type",
+ "domain",
+ "state",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
+ },
+ {
+ "action": "pages_protected_domain.verify",
+ "description": "A GitHub Pages domain was verified for an organization or enterprise.",
+ "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "owner_type",
+ "domain",
+ "state",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
+ },
+ {
+ "action": "payment_method.create",
+ "description": "A new payment method was added, such as a new credit card or PayPal account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "user",
+ "operation_type",
+ "user_id",
+ "_document_id",
+ "action",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "payment_method.remove",
+ "description": "A payment method was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "created_at",
+ "actor_id",
+ "@timestamp",
+ "user_id",
+ "action",
+ "operation_type",
+ "actor",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "payment_method.update",
+ "description": "An existing payment method was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "request_id",
+ "org_id",
+ "created_at",
+ "actor_id",
+ "@timestamp",
+ "action",
+ "actor",
+ "org",
+ "user_agent",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.access_granted",
+ "description": "A fine-grained personal access token was granted access to resources.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_id",
+ "user_programmatic_access_name",
+ "repository_selection",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
+ },
+ {
+ "action": "personal_access_token.access_restriction_disabled",
+ "description": "The configured restriction for access to resources via personal access tokens was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "programmatic_access_type",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.access_restriction_enabled",
+ "description": "The configured restriction for access to resources via personal access tokens was enabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "programmatic_access_type",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.access_revoked",
+ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_id",
+ "user_programmatic_access_name",
+ "repository_selection",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
+ },
+ {
+ "action": "personal_access_token.auto_approve_grant_requests_disabled",
+ "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "personal_access_token.auto_approve_grant_requests_enabled",
+ "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "personal_access_token.expiration_limit_set",
+ "description": "A personal access token expiration limit was set.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "programmatic_access_type",
+ "token_expiration",
+ "old_token_expiration",
+ "exempt_administrators",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.expiration_limit_unset",
+ "description": "A personal access token expiration limit was unset.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "programmatic_access_type",
+ "old_token_expiration",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.request_cancelled",
+ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_name",
+ "org",
+ "org_id",
+ "repository_selection",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "user_programmatic_access_request_id"
+ ]
+ },
+ {
+ "action": "personal_access_token.request_created",
+ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_id",
+ "user_programmatic_access_name",
+ "user",
+ "user_id",
+ "repository_selection",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "user_programmatic_access_request_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
+ },
+ {
+ "action": "personal_access_token.request_denied",
+ "description": "A request for a fine-grained personal access token to access organization resources was denied.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user_programmatic_access_name",
+ "org",
+ "org_id",
+ "repository_selection",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "user_programmatic_access_request_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
+ },
+ {
+ "action": "prebuild_configuration.create",
+ "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
+ "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "branch",
+ "repository",
+ "repository_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo"
+ ],
+ "docs_reference_titles": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
+ },
+ {
+ "action": "prebuild_configuration.destroy",
+ "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
+ "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "branch",
+ "repository",
+ "repository_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo"
+ ],
+ "docs_reference_titles": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
+ },
+ {
+ "action": "prebuild_configuration.run_triggered",
+ "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
+ "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "branch",
+ "repository",
+ "repository_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo"
+ ],
+ "docs_reference_titles": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
+ },
+ {
+ "action": "prebuild_configuration.update",
+ "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
+ "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "branch",
+ "repository",
+ "repository_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo"
+ ],
+ "docs_reference_titles": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
+ },
+ {
+ "action": "premium_runner.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "runner_group_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "premium_runner.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "premium_runner.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "runner_group_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "private_repository_forking.clear",
+ "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "business_id",
+ "actor_id",
+ "user",
+ "business",
+ "request_id",
+ "actor",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "private_repository_forking.disable",
+ "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo_id",
+ "created_at",
+ "actor_id",
+ "_document_id",
+ "actor",
+ "user",
+ "repo",
+ "action",
+ "user_agent",
+ "@timestamp",
+ "org",
+ "operation_type",
+ "request_id",
+ "user_id",
+ "org_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "private_repository_forking.enable",
+ "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user_id",
+ "operation_type",
+ "_document_id",
+ "action",
+ "@timestamp",
+ "repo",
+ "org",
+ "business",
+ "user_agent",
+ "request_id",
+ "actor",
+ "repo_id",
+ "user",
+ "org_id",
+ "created_at",
+ "business_id"
+ ]
+ },
+ {
+ "action": "private_vulnerability_reporting.disable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "private_vulnerability_reporting.enable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "private_vulnerability_reporting_new_repos.disable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "private_vulnerability_reporting_new_repos.enable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "profile_picture.update",
+ "description": "A profile picture was updated.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
+ "fields": [
+ "user",
+ "actor_id",
+ "user_id",
+ "@timestamp",
+ "created_at",
+ "owner",
+ "action",
+ "_document_id",
+ "request_id",
+ "user_agent",
+ "actor",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Personalize your profile"
+ },
+ {
+ "action": "project.access",
+ "description": "A project board visibility was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "actor",
+ "user_agent",
+ "operation_type",
+ "user",
+ "created_at",
+ "user_id",
+ "action",
+ "request_id",
+ "_document_id",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "project_base_role.update",
+ "description": "A project's base role was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "old_project_base_role",
+ "new_project_base_role",
+ "project_number",
+ "public_project",
+ "business",
+ "project_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "project.close",
+ "description": "A project board was closed.",
+ "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
+ "fields": [
+ "org_id",
+ "user_agent",
+ "request_id",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "repo_id",
+ "org",
+ "_document_id",
+ "project_id",
+ "action",
+ "actor",
+ "actor_id",
+ "repo",
+ "project_kind"
+ ],
+ "docs_reference_titles": "Closing a project (classic)"
+ },
+ {
+ "action": "project_collaborator.add",
+ "description": "A collaborator was added to a project.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "collaborator_type",
+ "org",
+ "org_id",
+ "collaborator",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "public_project",
+ "project_name",
+ "project_role",
+ "old_project_role",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "project_collaborator.remove",
+ "description": "A collaborator was removed from a project.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "collaborator_type",
+ "user",
+ "user_id",
+ "collaborator",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "project_collaborator.update",
+ "description": "A project collaborator's permission level was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "public_project",
+ "project_name",
+ "collaborator_type",
+ "project_role",
+ "old_project_role",
+ "project_id",
+ "user",
+ "user_id",
+ "collaborator",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "project.create",
+ "description": "A project board was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "user",
+ "_document_id",
+ "request_id",
+ "user_id",
+ "user_agent",
+ "@timestamp",
+ "actor_id",
+ "action",
+ "created_at",
+ "actor"
+ ]
+ },
+ {
+ "action": "project.delete",
+ "description": "A project board was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "action",
+ "actor_id",
+ "operation_type",
+ "actor",
+ "user_id",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "user"
+ ]
+ },
+ {
+ "action": "project_field.create",
+ "description": "A field was created in a project board.",
+ "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
+ },
+ {
+ "action": "project_field.delete",
+ "description": "A field was deleted in a project board.",
+ "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
+ },
+ {
+ "action": "project.link",
+ "description": "A repository was linked to a project board.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo_id",
+ "action",
+ "actor_id",
+ "org_id",
+ "user_agent",
+ "request_id",
+ "actor",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "created_at",
+ "org",
+ "repo"
+ ]
+ },
+ {
+ "action": "project.open",
+ "description": "A project board was reopened.",
+ "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
+ "fields": [
+ "actor",
+ "request_id",
+ "actor_id",
+ "action",
+ "user_id",
+ "project_id",
+ "_document_id",
+ "user_agent",
+ "operation_type",
+ "user",
+ "@timestamp",
+ "created_at",
+ "project_kind",
+ "project_name"
+ ],
+ "docs_reference_titles": "Reopening a closed project (classic)"
+ },
+ {
+ "action": "project.rename",
+ "description": "A project board was renamed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "created_at",
+ "request_id",
+ "actor_id",
+ "old_name",
+ "operation_type",
+ "@timestamp",
+ "repo",
+ "_document_id",
+ "user_agent",
+ "org_id",
+ "business_id",
+ "actor",
+ "repo_id",
+ "org",
+ "business"
+ ]
+ },
+ {
+ "action": "project.unlink",
+ "description": "A repository was unlinked from a project board.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "repo_id",
+ "operation_type",
+ "actor",
+ "action",
+ "created_at",
+ "actor_id",
+ "_document_id",
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "org",
+ "org_id"
+ ]
+ },
+ {
+ "action": "project.update_org_permission",
+ "description": "The project's base-level permission for all organization members was changed or removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "org",
+ "@timestamp",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "request_id",
+ "actor_id",
+ "action",
+ "org_id",
+ "user_agent"
+ ]
+ },
+ {
+ "action": "project.update_team_permission",
+ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "org_id",
+ "operation_type",
+ "org",
+ "actor_id",
+ "_document_id",
+ "request_id",
+ "team",
+ "@timestamp",
+ "action",
+ "user_agent",
+ "actor"
+ ]
+ },
+ {
+ "action": "project.update_user_permission",
+ "description": "A user was added to or removed from a project board or had their permission level changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "actor_id",
+ "user",
+ "user_agent",
+ "actor",
+ "created_at",
+ "org",
+ "_document_id",
+ "org_id",
+ "action",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "project_view.create",
+ "description": "A view was created in a project board.",
+ "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
+ },
+ {
+ "action": "project_view.delete",
+ "description": "A view was deleted in a project board.",
+ "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
+ },
+ {
+ "action": "project.visibility_private",
+ "description": "A project's visibility was changed from public to private.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "project_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "project_kind",
+ "project_name"
+ ]
+ },
+ {
+ "action": "project.visibility_public",
+ "description": "A project's visibility was changed from private to public.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "project_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "project_kind",
+ "project_name",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "protected_branch.authorized_users_teams",
+ "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
+ "fields": [
+ "repo",
+ "action",
+ "org_id",
+ "user_agent",
+ "name",
+ "created_at",
+ "_document_id",
+ "operation_type",
+ "actor",
+ "repo_id",
+ "org",
+ "request_id",
+ "actor_id",
+ "oauth_application_id",
+ "@timestamp",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
+ },
+ {
+ "action": "protected_branch.branch_allowances",
+ "description": "A protected branch allowance was given to a specific user, team or integration.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "token_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "name",
+ "authorized_actors",
+ "policy",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "protected_branch.create",
+ "description": "Branch protection was enabled on a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "repo_id",
+ "user_id",
+ "@timestamp",
+ "user_agent",
+ "repo",
+ "name",
+ "org_id",
+ "user",
+ "_document_id",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "action",
+ "created_at",
+ "authorized_actor_names",
+ "token_scopes",
+ "required_deployments_enforcement_level",
+ "merge_queue_enforcement_level",
+ "create_protected"
+ ]
+ },
+ {
+ "action": "protected_branch.destroy",
+ "description": "Branch protection was disabled on a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "name",
+ "repo",
+ "@timestamp",
+ "actor",
+ "org",
+ "actor_id",
+ "request_id",
+ "repo_id",
+ "org_id",
+ "operation_type",
+ "action",
+ "user_agent",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "required_deployments_enforcement_level",
+ "merge_queue_enforcement_level",
+ "create_protected"
+ ]
+ },
+ {
+ "action": "protected_branch.dismiss_stale_reviews",
+ "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "dismiss_stale_reviews_on_push",
+ "org_id",
+ "action",
+ "created_at",
+ "request_id",
+ "_document_id",
+ "@timestamp",
+ "actor_id",
+ "repo_id",
+ "operation_type",
+ "actor",
+ "repo",
+ "org",
+ "name",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.dismissal_restricted_users_teams",
+ "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "repo_id",
+ "actor",
+ "oauth_application_id",
+ "authorized_actors_only",
+ "authorized_actors",
+ "created_at",
+ "user_agent",
+ "name",
+ "_document_id",
+ "org_id",
+ "request_id",
+ "@timestamp",
+ "actor_id",
+ "org",
+ "action",
+ "operation_type",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.policy_override",
+ "description": "A branch protection requirement was overridden by a repository administrator.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo_id",
+ "created_at",
+ "actor",
+ "reasons",
+ "@timestamp",
+ "before",
+ "after",
+ "actor_id",
+ "repo",
+ "operation_type",
+ "user_agent",
+ "branch",
+ "overridden_codes",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "request_id",
+ "referrer",
+ "business",
+ "business_id",
+ "deploy_key_fingerprint",
+ "token_scopes",
+ "programmatic_access_type",
+ "compliant_pull_request_ids",
+ "rule_suite_id"
+ ]
+ },
+ {
+ "action": "protected_branch.rejected_ref_update",
+ "description": "A branch update attempt was rejected.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "org",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "org_id",
+ "operation_type",
+ "request_id",
+ "repo_id",
+ "actor",
+ "branch",
+ "before",
+ "overridden_codes",
+ "after",
+ "action",
+ "reasons",
+ "actor_id",
+ "business_id",
+ "deploy_key_fingerprint",
+ "token_scopes",
+ "programmatic_access_type",
+ "compliant_pull_request_ids",
+ "actor_is_bot",
+ "rule_suite_id"
+ ]
+ },
+ {
+ "action": "protected_branch.update_admin_enforced",
+ "description": "Branch protection was enforced for repository administrators.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "admin_enforced",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "org",
+ "name",
+ "repo",
+ "@timestamp",
+ "action",
+ "repo_id",
+ "org_id",
+ "_document_id",
+ "created_at",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_allow_deletions_enforcement_level",
+ "description": "Branch deletion was enabled or disabled for a protected branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "name",
+ "operation_type",
+ "request_id",
+ "repo",
+ "@timestamp",
+ "org_id",
+ "org",
+ "action",
+ "allow_deletions_enforcement_level",
+ "_document_id",
+ "created_at",
+ "actor_id",
+ "user_agent",
+ "actor",
+ "repo_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "protected_branch.update_allow_force_pushes_enforcement_level",
+ "description": "Force pushes were enabled or disabled for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "actor_id",
+ "name",
+ "_document_id",
+ "actor",
+ "repo",
+ "operation_type",
+ "request_id",
+ "allow_force_pushes_enforcement_level",
+ "@timestamp",
+ "org",
+ "action",
+ "created_at",
+ "user_agent",
+ "repo_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_ignore_approvals_from_contributors",
+ "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "ignore_approvals_from_contributors",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+ },
+ {
+ "action": "protected_branch.update_linear_history_requirement_enforcement_level",
+ "description": "Required linear commit history was enabled or disabled for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "user_agent",
+ "operation_type",
+ "actor",
+ "linear_history_requirement_enforcement_level",
+ "repo",
+ "request_id",
+ "name",
+ "org_id",
+ "repo_id",
+ "org",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_lock_allows_fetch_and_merge",
+ "description": "Fork syncing was enabled or disabled for a read-only branch",
+ "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "lock_allows_fetch_and_merge",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
+ },
+ {
+ "action": "protected_branch.update_lock_branch_enforcement_level",
+ "description": "The enforcement of a branch lock was updated.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "enforcement_level",
+ "lock_branch_enforcement_level",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
+ },
+ {
+ "action": "protected_branch.update_merge_queue_enforcement_level",
+ "description": "Enforcement of the merge queue was modified for a branch.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "merge_queue_enforcement_level",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
+ },
+ {
+ "action": "protected_branch.update_name",
+ "description": "A branch name pattern was updated for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "old_name",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "protected_branch.update_pull_request_reviews_enforcement_level",
+ "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "name",
+ "org_id",
+ "_document_id",
+ "actor_id",
+ "@timestamp",
+ "business_id",
+ "request_id",
+ "pull_request_reviews_enforcement_level",
+ "org",
+ "repo",
+ "action",
+ "business",
+ "user_agent",
+ "created_at",
+ "repo_id",
+ "operation_type",
+ "actor",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_require_code_owner_review",
+ "description": "Enforcement of required code owner review was updated for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "created_at",
+ "require_code_owner_review",
+ "operation_type",
+ "name",
+ "user_agent",
+ "action",
+ "@timestamp",
+ "actor",
+ "actor_id",
+ "repo",
+ "request_id",
+ "org",
+ "repo_id",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_require_last_push_approval",
+ "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "require_last_push_approval",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
+ },
+ {
+ "action": "protected_branch.update_required_approving_review_count",
+ "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "required_approving_review_count",
+ "repo",
+ "request_id",
+ "repo_id",
+ "created_at",
+ "actor",
+ "operation_type",
+ "user_agent",
+ "name",
+ "org_id",
+ "action",
+ "actor_id",
+ "_document_id",
+ "org",
+ "@timestamp",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_required_status_checks_enforcement_level",
+ "description": "Enforcement of required status checks was updated for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "org_id",
+ "user_agent",
+ "@timestamp",
+ "_document_id",
+ "name",
+ "repo",
+ "action",
+ "business_id",
+ "repo_id",
+ "business",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "request_id",
+ "required_status_checks_enforcement_level",
+ "org",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_signature_requirement_enforcement_level",
+ "description": "Enforcement of required commit signing was updated for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "name",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "actor",
+ "actor_id",
+ "signature_requirement_enforcement_level",
+ "repo",
+ "user_agent",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "protected_branch.update_strict_required_status_checks_policy",
+ "description": "Enforcement of required status checks was updated for a branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "_document_id",
+ "org",
+ "@timestamp",
+ "created_at",
+ "repo_id",
+ "org_id",
+ "user_agent",
+ "name",
+ "actor",
+ "repo",
+ "operation_type",
+ "action",
+ "strict_required_status_checks_policy",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "public_key.create",
+ "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
+ "fields": [
+ "read_only",
+ "user_agent",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "_document_id",
+ "key",
+ "fingerprint",
+ "actor",
+ "action",
+ "user",
+ "user_id",
+ "@timestamp",
+ "request_id",
+ "title",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
+ },
+ {
+ "action": "public_key.delete",
+ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
+ "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
+ "fields": [
+ "fingerprint",
+ "user_agent",
+ "read_only",
+ "explanation",
+ "repo",
+ "@timestamp",
+ "action",
+ "key",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "title",
+ "request_id",
+ "actor_id",
+ "repo_id",
+ "created_at",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
+ },
+ {
+ "action": "public_key.unverification_failure",
+ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "title",
+ "key",
+ "fingerprint",
+ "read_only",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "public_key.unverify",
+ "description": "A user account's SSH key or a repository's deploy key was unverified.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "created_at",
+ "operation_type",
+ "_document_id",
+ "title",
+ "request_id",
+ "key",
+ "action",
+ "actor",
+ "read_only",
+ "explanation",
+ "repo_id",
+ "@timestamp",
+ "actor_id",
+ "repo",
+ "user_agent",
+ "fingerprint"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "public_key.update",
+ "description": "A user account's SSH key or a repository's deploy key was updated.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "actor",
+ "user_agent",
+ "key",
+ "fingerprint",
+ "read_only",
+ "repo_id",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "repo",
+ "action",
+ "_document_id",
+ "request_id",
+ "title",
+ "@timestamp",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "public_key.verification_failure",
+ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "repo_id",
+ "actor",
+ "key",
+ "fingerprint",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "oauth_application_id",
+ "title",
+ "action",
+ "user_agent",
+ "created_at",
+ "repo",
+ "read_only",
+ "operation_type",
+ "_document_id",
+ "user",
+ "user_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "public_key.verify",
+ "description": "A user account's SSH key or a repository's deploy key was verified.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "operation_type",
+ "user",
+ "@timestamp",
+ "_document_id",
+ "action",
+ "created_at",
+ "key",
+ "fingerprint",
+ "actor_id",
+ "actor",
+ "title",
+ "user_agent",
+ "user_id",
+ "request_id",
+ "read_only",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "pull_request.close",
+ "description": "A pull request was closed without being merged.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
+ },
+ {
+ "action": "pull_request.converted_to_draft",
+ "description": "A pull request was converted to a draft.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
+ },
+ {
+ "action": "pull_request.create",
+ "description": "A pull request was created.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request"
+ },
+ {
+ "action": "pull_request.create_review_request",
+ "description": "A review was requested on a pull request.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "org_id",
+ "reviewer_type",
+ "reviewer",
+ "reviewer_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
+ },
+ {
+ "action": "pull_request.in_progress",
+ "description": "A pull request was marked as in progress.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "pull_request.indirect_merge",
+ "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "pull_request.merge",
+ "description": "A pull request was merged.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
+ },
+ {
+ "action": "pull_request.ready_for_review",
+ "description": "A pull request was marked as ready for review.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
+ },
+ {
+ "action": "pull_request.rebase",
+ "description": "A pull request was rebased.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "pull_request_url",
+ "pull_request_title",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "pull_request.remove_review_request",
+ "description": "A review request was removed from a pull request.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "org_id",
+ "reviewer_type",
+ "reviewer",
+ "reviewer_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
+ },
+ {
+ "action": "pull_request.reopen",
+ "description": "A pull request was reopened after previously being closed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "pull_request_review_comment.create",
+ "description": "A review comment was added to a pull request.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "comment_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
+ },
+ {
+ "action": "pull_request_review_comment.delete",
+ "description": "A review comment on a pull request was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "actor",
+ "@timestamp",
+ "_document_id",
+ "repo",
+ "created_at",
+ "request_id",
+ "comment_id",
+ "actor_id",
+ "repo_id",
+ "action",
+ "operation_type",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "pull_request_review_comment.update",
+ "description": "A review comment on a pull request was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "action",
+ "created_at",
+ "actor",
+ "_document_id",
+ "@timestamp",
+ "comment_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "pull_request_review.delete",
+ "description": "A review on a pull request was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "review_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "pull_request_review.dismiss",
+ "description": "A review on a pull request was dismissed.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "business_id",
+ "review_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
+ },
+ {
+ "action": "pull_request_review.submit",
+ "description": "A review on a pull request was submitted.",
+ "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "pull_request_id",
+ "review_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "pull_request_url",
+ "programmatic_access_type",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
+ },
+ {
+ "action": "repo.access",
+ "description": "The visibility of a repository changed.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
+ "fields": [
+ "repo_id",
+ "user",
+ "request_id",
+ "operation_type",
+ "@timestamp",
+ "actor_id",
+ "user_id",
+ "created_at",
+ "user_agent",
+ "actor",
+ "action",
+ "repo",
+ "visibility",
+ "_document_id",
+ "previous_visibility",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
+ },
+ {
+ "action": "repo.actions_enabled",
+ "description": "GitHub Actions was enabled for a repository.",
+ "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
+ },
+ {
+ "action": "repo.add_member",
+ "description": "A collaborator was added to a repository.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
+ "fields": [
+ "visibility",
+ "repo",
+ "created_at",
+ "user_agent",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "repo_id",
+ "user",
+ "request_id",
+ "action",
+ "user_id",
+ "oauth_application_id",
+ "org",
+ "org_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Inviting collaborators to a personal repository"
+ },
+ {
+ "action": "repo.add_topic",
+ "description": "A topic was added to a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
+ "fields": [
+ "action",
+ "user_agent",
+ "actor",
+ "repo",
+ "repo_id",
+ "user",
+ "org",
+ "org_id",
+ "request_id",
+ "actor_id",
+ "topic",
+ "@timestamp",
+ "_document_id",
+ "user_id",
+ "created_at",
+ "operation_type",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
+ },
+ {
+ "action": "repo.advanced_security_disabled",
+ "description": "GitHub Advanced Security was disabled for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "repository",
+ "repository_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
+ },
+ {
+ "action": "repo.advanced_security_enabled",
+ "description": "GitHub Advanced Security was enabled for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "repository",
+ "repository_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
+ },
+ {
+ "action": "repo.archived",
+ "description": "A repository was archived.",
+ "docs_reference_links": "/repositories/archiving-a-github-repository",
+ "fields": [
+ "repo_id",
+ "user_agent",
+ "user_id",
+ "created_at",
+ "@timestamp",
+ "repo",
+ "user",
+ "operation_type",
+ "visibility",
+ "action",
+ "actor_id",
+ "actor",
+ "_document_id",
+ "request_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/archiving-a-github-repository"
+ },
+ {
+ "action": "repo.change_merge_setting",
+ "description": "Pull request merge options were changed for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "oauth_application_id",
+ "user_agent",
+ "request_id",
+ "created_at",
+ "@timestamp",
+ "_document_id",
+ "actor_id",
+ "operation_type",
+ "action",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repo.code_scanning_analysis_deleted",
+ "description": "Code scanning analysis for a repository was deleted.",
+ "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "tool",
+ "category",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
+ },
+ {
+ "action": "repo.code_scanning_autofix_disabled",
+ "description": "Autofix for code scanning alerts was disabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.code_scanning_autofix_enabled",
+ "description": "Autofix for code scanning alerts was enabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.code_scanning_autofix_third_party_tools_disabled",
+ "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.code_scanning_autofix_third_party_tools_enabled",
+ "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.code_scanning_configuration_for_branch_deleted",
+ "description": "A code scanning configuration for a branch of a repository was deleted.",
+ "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "tool",
+ "branch",
+ "category",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Resolving code scanning alerts"
+ },
+ {
+ "action": "repo.code_scanning_delegated_alert_dismissal_disabled",
+ "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "repo.code_scanning_delegated_alert_dismissal_enabled",
+ "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "repo.codeql_disabled",
+ "description": "Code scanning using the default setup was disabled for a repository.",
+ "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Configuring default setup for code scanning"
+ },
+ {
+ "action": "repo.codeql_enabled",
+ "description": "Code scanning using the default setup was enabled for a repository.",
+ "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "query_suite",
+ "threat_model",
+ "languages",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Configuring default setup for code scanning"
+ },
+ {
+ "action": "repo.codeql_updated",
+ "description": "Code scanning using the default setup was updated for a repository.",
+ "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "query_suite",
+ "threat_model",
+ "languages",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Configuring default setup for code scanning"
+ },
+ {
+ "action": "repo.codespaces_trusted_repo_access_granted",
+ "description": "GitHub Codespaces was granted trusted repository access to this repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo"
+ ]
+ },
+ {
+ "action": "repo.codespaces_trusted_repo_access_revoked",
+ "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "repo.config.disable_collaborators_only",
+ "description": "The interaction limit for collaborators only was disabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "user_agent",
+ "actor",
+ "actor_id",
+ "repo_id",
+ "_document_id",
+ "action",
+ "created_at",
+ "repo",
+ "operation_type",
+ "@timestamp",
+ "request_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.disable_contributors_only",
+ "description": "The interaction limit for prior contributors only was disabled in a repository.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "repo",
+ "@timestamp",
+ "request_id",
+ "actor",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "repo_id",
+ "action",
+ "operation_type",
+ "created_at"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.disable_sockpuppet_disallowed",
+ "description": "The interaction limit for existing users only was disabled in a repository.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "actor",
+ "request_id",
+ "repo_id",
+ "action",
+ "user_agent",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "actor_id",
+ "repo",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.enable_collaborators_only",
+ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "actor",
+ "oauth_application_id",
+ "created_at",
+ "action",
+ "request_id",
+ "repo_id",
+ "repo",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.enable_contributors_only",
+ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "operation_type",
+ "created_at",
+ "actor",
+ "org",
+ "action",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "org_id",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.enable_sockpuppet_disallowed",
+ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "actor",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "request_id",
+ "action",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.configure_self_hosted_jit_runner",
+ "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
+ "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
+ },
+ {
+ "action": "repo.create",
+ "description": "A repository was created.",
+ "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
+ "fields": [
+ "repo",
+ "user_id",
+ "visibility",
+ "repo_id",
+ "user",
+ "request_id",
+ "actor_id",
+ "action",
+ "operation_type",
+ "request_category",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "actor",
+ "user_agent",
+ "org",
+ "oauth_application_id",
+ "org_id",
+ "request_method",
+ "business",
+ "business_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
+ },
+ {
+ "action": "repo.create_actions_secret",
+ "description": "A GitHub Actions secret was created for a repository.",
+ "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Using secrets in GitHub Actions"
+ },
+ {
+ "action": "repo.create_actions_variable",
+ "description": "A GitHub Actions variable was created for a repository.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "repo.create_integration_secret",
+ "description": "A Codespaces or Dependabot secret was created for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "visibility",
+ "integration",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.destroy",
+ "description": "A repository was deleted.",
+ "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
+ "fields": [
+ "repo",
+ "_document_id",
+ "user_agent",
+ "user_id",
+ "actor",
+ "action",
+ "user",
+ "repo_id",
+ "operation_type",
+ "request_category",
+ "actor_id",
+ "visibility",
+ "request_id",
+ "created_at",
+ "@timestamp",
+ "request_method",
+ "oauth_application_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
+ },
+ {
+ "action": "repo.download_zip",
+ "description": "A source code archive of a repository was downloaded as a ZIP file.",
+ "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
+ },
+ {
+ "action": "repo.immutable_releases_settings_disabled",
+ "description": "The setting for immutable releases was disabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repo.immutable_releases_settings_enabled",
+ "description": "The setting for immutable releases was enabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repo.pages_cname",
+ "description": "A GitHub Pages custom domain was modified in a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "@timestamp",
+ "visibility",
+ "repo",
+ "repo_id",
+ "user",
+ "request_id",
+ "actor_id",
+ "cname",
+ "user_agent",
+ "user_id",
+ "created_at",
+ "_document_id",
+ "action",
+ "operation_type",
+ "old_cname",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.pages_create",
+ "description": "A GitHub Pages site was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user",
+ "_document_id",
+ "user_id",
+ "visibility",
+ "action",
+ "user_agent",
+ "operation_type",
+ "repo_id",
+ "created_at",
+ "@timestamp",
+ "request_id",
+ "actor",
+ "repo",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.pages_destroy",
+ "description": "A GitHub Pages site was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "user_id",
+ "action",
+ "request_id",
+ "user",
+ "repo",
+ "user_agent",
+ "_document_id",
+ "actor_id",
+ "@timestamp",
+ "actor",
+ "visibility",
+ "operation_type",
+ "repo_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.pages_https_redirect_disabled",
+ "description": "HTTPS redirects were disabled for a GitHub Pages site.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "actor_id",
+ "repo_id",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "visibility",
+ "user_id",
+ "request_id",
+ "repo",
+ "@timestamp",
+ "operation_type",
+ "action",
+ "created_at",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_https_redirect_enabled",
+ "description": "HTTPS redirects were enabled for a GitHub Pages site.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "user_id",
+ "created_at",
+ "visibility",
+ "actor",
+ "actor_id",
+ "user",
+ "operation_type",
+ "repo_id",
+ "action",
+ "repo",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_private",
+ "description": "A GitHub Pages site visibility was changed to private.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "repo.pages_public",
+ "description": "A GitHub Pages site visibility was changed to public.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_soft_delete",
+ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_soft_delete_restore",
+ "description": "A GitHub Pages site that was previously soft-deleted was restored.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_source",
+ "description": "A GitHub Pages source was modified.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "actor_id",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "@timestamp",
+ "repo_id",
+ "user",
+ "_document_id",
+ "request_id",
+ "visibility",
+ "repo",
+ "created_at",
+ "action",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.register_self_hosted_runner",
+ "description": "A new self-hosted runner was registered.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
+ "fields": [
+ "actor_id",
+ "repo",
+ "operation_type",
+ "action",
+ "@timestamp",
+ "actor",
+ "user_agent",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "repo_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Adding self-hosted runners"
+ },
+ {
+ "action": "repo.remove_actions_secret",
+ "description": "A GitHub Actions secret was deleted for a repository.",
+ "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Using secrets in GitHub Actions"
+ },
+ {
+ "action": "repo.remove_actions_variable",
+ "description": "A GitHub Actions variable was deleted for a repository.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "repo.remove_integration_secret",
+ "description": "A Codespaces or Dependabot secret was deleted for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "integration",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.remove_member",
+ "description": "A collaborator was removed from a repository.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
+ "fields": [
+ "request_id",
+ "user",
+ "business",
+ "action",
+ "actor_id",
+ "org",
+ "org_id",
+ "actor",
+ "created_at",
+ "repo_id",
+ "user_agent",
+ "business_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "visibility",
+ "repo",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Removing a collaborator from a personal repository"
+ },
+ {
+ "action": "repo.remove_self_hosted_runner",
+ "description": "A self-hosted runner was removed.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "repo_id",
+ "@timestamp",
+ "_document_id",
+ "repo",
+ "org_id",
+ "action",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "created_at",
+ "org",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Removing self-hosted runners"
+ },
+ {
+ "action": "repo.remove_topic",
+ "description": "A topic was removed from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "action",
+ "repo_id",
+ "user_agent",
+ "topic",
+ "operation_type",
+ "user_id",
+ "org",
+ "org_id",
+ "actor",
+ "business",
+ "request_id",
+ "repo",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "actor_id",
+ "business_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.rename",
+ "description": "A repository was renamed.",
+ "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
+ "fields": [
+ "user_agent",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "actor",
+ "old_name",
+ "repo",
+ "user_id",
+ "created_at",
+ "user",
+ "action",
+ "operation_type",
+ "visibility",
+ "repo_id",
+ "_document_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
+ },
+ {
+ "action": "repo.rename_branch",
+ "description": "A branch was renamed.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "old_branch",
+ "new_branch",
+ "default_branch",
+ "repo",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch"
+ },
+ {
+ "action": "repo.restore",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "action",
+ "_document_id",
+ "actor_id",
+ "user",
+ "operation_type",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "@timestamp",
+ "created_at",
+ "actor",
+ "user_id"
+ ]
+ },
+ {
+ "action": "repo.self_hosted_runner_offline",
+ "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
+ "fields": [
+ "repo_id",
+ "repo",
+ "org_id",
+ "org",
+ "runner_id",
+ "runner_name",
+ "action",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+ },
+ {
+ "action": "repo.self_hosted_runner_online",
+ "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
+ "fields": [
+ "repo_id",
+ "repo",
+ "org_id",
+ "org",
+ "runner_id",
+ "runner_name",
+ "action",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+ },
+ {
+ "action": "repo.self_hosted_runner_updated",
+ "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
+ "fields": [
+ "repo_id",
+ "runner_id",
+ "runner_name",
+ "source_version",
+ "target_version",
+ "runner_group_id",
+ "runner_group_name"
+ ],
+ "docs_reference_titles": "Self-hosted runners"
+ },
+ {
+ "action": "repo.set_actions_cache_retention_policy",
+ "description": "The cache retention policy for GitHub Actions was set for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
+ },
+ {
+ "action": "repo.set_actions_cache_storage_policy",
+ "description": "The cache storage policy for GitHub Actions was set for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
+ },
+ {
+ "action": "repo.set_actions_fork_pr_approvals_policy",
+ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "policy",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
+ },
+ {
+ "action": "repo.set_actions_private_fork_pr_approvals_policy",
+ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "visibility",
+ "policy",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
+ },
+ {
+ "action": "repo.set_actions_retention_limit",
+ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "limit",
+ "repo",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
+ },
+ {
+ "action": "repo.set_default_workflow_permissions",
+ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
+ },
+ {
+ "action": "repo.set_fork_pr_workflows_policy",
+ "description": "Triggered when the policy for workflows on private repository forks is changed.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "policy",
+ "repo",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
+ },
+ {
+ "action": "repo.set_workflow_permission_can_approve_pr",
+ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
+ },
+ {
+ "action": "repo.staff_unlock",
+ "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "created_at",
+ "actor",
+ "repo_id",
+ "action",
+ "org",
+ "org_id",
+ "request_id",
+ "repo",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "repo.transfer",
+ "description": "A user accepted a request to receive a transferred repository.",
+ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
+ "fields": [
+ "@timestamp",
+ "user_id",
+ "_document_id",
+ "request_id",
+ "actor_id",
+ "repo_id",
+ "owner",
+ "user",
+ "old_user",
+ "action",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "repo",
+ "visibility",
+ "repo_was",
+ "actor"
+ ],
+ "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
+ },
+ {
+ "action": "repo.transfer_outgoing",
+ "description": "A repository was transferred to another repository network.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "new_nwo",
+ "visibility",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.transfer_start",
+ "description": "A user sent a request to transfer a repository to another user or organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "_document_id",
+ "operation_type",
+ "user_id",
+ "request_id",
+ "user",
+ "action",
+ "user_agent",
+ "created_at",
+ "actor",
+ "visibility",
+ "repo_id",
+ "actor_id",
+ "repo",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.unarchived",
+ "description": "A repository was unarchived.",
+ "docs_reference_links": "/repositories/archiving-a-github-repository",
+ "fields": [
+ "actor",
+ "request_id",
+ "actor_id",
+ "repo",
+ "operation_type",
+ "created_at",
+ "_document_id",
+ "repo_id",
+ "user",
+ "@timestamp",
+ "visibility",
+ "user_agent",
+ "user_id",
+ "action",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/archiving-a-github-repository"
+ },
+ {
+ "action": "repo.update_actions_access_settings",
+ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "policy",
+ "old_policy",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "repo.update_actions_secret",
+ "description": "A GitHub Actions secret was updated for a repository.",
+ "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "key",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Using secrets in GitHub Actions"
+ },
+ {
+ "action": "repo.update_actions_settings",
+ "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "new_policy",
+ "old_policy",
+ "updated_access_policy",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repo.update_actions_variable",
+ "description": "A GitHub Actions variable was updated for a repository.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "repo.update_default_branch",
+ "description": "The default branch for a repository was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repo.update_integration_secret",
+ "description": "A Codespaces or Dependabot secret was updated for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "visibility",
+ "integration",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.update_member",
+ "description": "A user's permission to a repository was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "action",
+ "_document_id",
+ "actor",
+ "repo_id",
+ "created_at",
+ "oauth_application_id",
+ "user",
+ "@timestamp",
+ "repo",
+ "operation_type",
+ "request_id",
+ "org_id",
+ "actor_id",
+ "visibility",
+ "old_permission",
+ "org",
+ "user_id",
+ "old_base_role",
+ "old_repo_permission",
+ "old_repo_base_role",
+ "new_repo_base_role",
+ "new_repo_permission",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repository_advisory.close",
+ "description": "Someone closed a security advisory.",
+ "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories",
+ "fields": [
+ "actor",
+ "repo",
+ "@timestamp",
+ "business",
+ "business_id",
+ "user_agent",
+ "actor_id",
+ "request_id",
+ "action",
+ "operation_type",
+ "created_at",
+ "repo_id",
+ "_document_id",
+ "org",
+ "org_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About repository security advisories"
+ },
+ {
+ "action": "repository_advisory.cve_request",
+ "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo_id",
+ "repo",
+ "org_id",
+ "actor",
+ "action",
+ "request_id",
+ "org",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "actor_id",
+ "_document_id",
+ "created_at"
+ ]
+ },
+ {
+ "action": "repository_advisory.github_broadcast",
+ "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo"
+ ]
+ },
+ {
+ "action": "repository_advisory.github_withdraw",
+ "description": "GitHub withdrew a security advisory that was published in error.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "repository_advisory.open",
+ "description": "Someone opened a draft security advisory.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "user_agent",
+ "actor_id",
+ "actor",
+ "repo",
+ "created_at",
+ "_document_id",
+ "repo_id",
+ "action",
+ "@timestamp",
+ "request_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_advisory.publish",
+ "description": "Someone published a security advisory.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "user_agent",
+ "actor_id",
+ "@timestamp",
+ "actor",
+ "repo_id",
+ "_document_id",
+ "repo",
+ "business_id",
+ "business",
+ "request_id",
+ "action",
+ "created_at",
+ "org_id",
+ "org"
+ ]
+ },
+ {
+ "action": "repository_advisory.reopen",
+ "description": "Someone reopened as draft security advisory.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "user_agent",
+ "repo",
+ "action",
+ "created_at",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "_document_id",
+ "actor",
+ "repo_id",
+ "public_repo"
+ ]
+ },
+ {
+ "action": "repository_advisory.update",
+ "description": "Someone edited a draft or published security advisory.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "repo_id",
+ "org_id",
+ "business",
+ "actor",
+ "user_agent",
+ "created_at",
+ "_document_id",
+ "business_id",
+ "repo",
+ "action",
+ "operation_type",
+ "org",
+ "@timestamp",
+ "request_id"
+ ]
+ },
+ {
+ "action": "repository_branch_protection_evaluation.disable",
+ "description": "Branch protections were disabled for the repository.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "business_id",
+ "user",
+ "user_id",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+ },
+ {
+ "action": "repository_branch_protection_evaluation.enable",
+ "description": "Branch protections were enabled for this repository.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "business_id",
+ "user",
+ "user_id",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+ },
+ {
+ "action": "repository_code_security.disable",
+ "description": "Code security was disabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repository_code_security.enable",
+ "description": "Code security was enabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repository_content_analysis.disable",
+ "description": "Data use settings were disabled for a private repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
+ "fields": [
+ "user",
+ "repo_id",
+ "request_id",
+ "actor_id",
+ "created_at",
+ "user_agent",
+ "action",
+ "operation_type",
+ "actor",
+ "repo",
+ "user_id",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
+ },
+ {
+ "action": "repository_content_analysis.enable",
+ "description": "Data use settings were enabled for a private repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
+ "fields": [
+ "user",
+ "org",
+ "user_id",
+ "repo_id",
+ "@timestamp",
+ "request_id",
+ "actor",
+ "action",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "repo",
+ "user_agent",
+ "org_id",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
+ },
+ {
+ "action": "repository_dependency_graph.disable",
+ "description": "The dependency graph was disabled for a private repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
+ "fields": [
+ "repo_id",
+ "operation_type",
+ "user_id",
+ "repo",
+ "_document_id",
+ "actor",
+ "user",
+ "action",
+ "@timestamp",
+ "org_id",
+ "actor_id",
+ "org",
+ "created_at",
+ "user_agent",
+ "request_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
+ },
+ {
+ "action": "repository_dependency_graph.enable",
+ "description": "The dependency graph was enabled for a private repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "user",
+ "org",
+ "org_id",
+ "action",
+ "repo",
+ "user_id",
+ "created_at",
+ "user_agent",
+ "actor_id",
+ "repo_id",
+ "operation_type",
+ "actor",
+ "@timestamp",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repository_image.create",
+ "description": "An image to represent a repository was uploaded.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "repo_id",
+ "action",
+ "request_id",
+ "actor",
+ "content_type",
+ "repo",
+ "@timestamp",
+ "_document_id",
+ "user",
+ "user_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_image.destroy",
+ "description": "An image to represent a repository was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "content_type",
+ "created_at",
+ "actor_id",
+ "user_id",
+ "operation_type",
+ "request_id",
+ "_document_id",
+ "actor",
+ "repo_id",
+ "user_agent",
+ "repo",
+ "user",
+ "action",
+ "@timestamp",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_invitation.accept",
+ "description": "An invitation to join a repository was accepted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "created_at",
+ "request_id",
+ "repo",
+ "invitee",
+ "operation_type",
+ "actor",
+ "repo_id",
+ "_document_id",
+ "action",
+ "user_agent",
+ "inviter",
+ "@timestamp",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repository_invitation.cancel",
+ "description": "An invitation to join a repository was canceled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "inviter",
+ "action",
+ "operation_type",
+ "_document_id",
+ "repo_id",
+ "repo",
+ "@timestamp",
+ "user_agent",
+ "invitee",
+ "created_at",
+ "request_id",
+ "actor",
+ "actor_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_invitation.create",
+ "description": "An invitation to join a repository was sent.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "invitee",
+ "action",
+ "request_id",
+ "inviter",
+ "repo",
+ "created_at",
+ "user_agent",
+ "repo_id",
+ "operation_type",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repository_invitation.reject",
+ "description": "An invitation to join a repository was declined.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "_document_id",
+ "actor",
+ "invitee",
+ "action",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "inviter",
+ "user_agent",
+ "repo_id"
+ ]
+ },
+ {
+ "action": "repository_limit.reached",
+ "description": "An organization has reached their repository limit.",
+ "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "limit",
+ "count",
+ "owner",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "repositories/creating-and-managing-repositories/repository-limits"
+ },
+ {
+ "action": "repository_limit.warning",
+ "description": "An organization is approaching their repository limit.",
+ "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "limit",
+ "count",
+ "owner",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "repositories/creating-and-managing-repositories/repository-limits"
+ },
+ {
+ "action": "repository_projects_change.clear",
+ "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise",
+ "fields": [
+ "request_id",
+ "created_at",
+ "_document_id",
+ "action",
+ "user_agent",
+ "user",
+ "business_id",
+ "business",
+ "operation_type",
+ "actor",
+ "actor_id",
+ "user_id",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Enforcing policies for projects in your enterprise"
+ },
+ {
+ "action": "repository_projects_change.disable",
+ "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "@timestamp",
+ "repo",
+ "action",
+ "operation_type",
+ "_document_id",
+ "actor_id",
+ "user",
+ "user_id",
+ "user_agent",
+ "repo_id",
+ "actor",
+ "request_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repository_projects_change.enable",
+ "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "actor",
+ "repo_id",
+ "org",
+ "request_id",
+ "user",
+ "user_agent",
+ "created_at",
+ "org_id",
+ "action",
+ "user_id",
+ "operation_type",
+ "_document_id",
+ "actor_id",
+ "repo"
+ ]
+ },
+ {
+ "action": "repository_ruleset.create",
+ "description": "A repository ruleset was created.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "ruleset_id",
+ "ruleset_name",
+ "ruleset_enforcement",
+ "ruleset_source_type",
+ "ruleset_rules",
+ "ruleset_conditions",
+ "ruleset_bypass_actors",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
+ },
+ {
+ "action": "repository_ruleset.destroy",
+ "description": "A repository ruleset was deleted.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "ruleset_id",
+ "ruleset_name",
+ "ruleset_enforcement",
+ "ruleset_source_type",
+ "ruleset_rules",
+ "ruleset_bypass_actors",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
+ },
+ {
+ "action": "repository_ruleset.update",
+ "description": "A repository ruleset was edited.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "old_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "ruleset_id",
+ "ruleset_name",
+ "ruleset_enforcement",
+ "ruleset_source_type",
+ "ruleset_rules_updated",
+ "ruleset_conditions_added",
+ "ruleset_conditions_deleted",
+ "ruleset_old_enforcement",
+ "ruleset_rules_added",
+ "ruleset_rules_deleted",
+ "ruleset_old_name",
+ "ruleset_conditions_updated",
+ "ruleset_bypass_actors_added",
+ "ruleset_bypass_actors_deleted",
+ "ruleset_bypass_actors_updated",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
+ },
+ {
+ "action": "repository_secret_scanning_automatic_validity_checks.disabled",
+ "description": "Automatic partner validation checks have been disabled at the repository level",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
+ },
+ {
+ "action": "repository_secret_scanning_automatic_validity_checks.enabled",
+ "description": "Automatic partner validation checks have been enabled at the repository level",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
+ },
+ {
+ "action": "repository_secret_scanning_custom_pattern.create",
+ "description": "A custom pattern was created for secret scanning in a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning_custom_pattern.delete",
+ "description": "A custom pattern was removed from secret scanning in a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning_custom_pattern.publish",
+ "description": "A custom pattern was published for secret scanning in a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning_custom_pattern_push_protection.disabled",
+ "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning_custom_pattern_push_protection.enabled",
+ "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning_custom_pattern.update",
+ "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo"
+ ],
+ "docs_reference_titles": "Defining custom patterns for secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning.disable",
+ "description": "Secret scanning was disabled for a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "About secret scanning"
+ },
+ {
+ "action": "repository_secret_scanning.enable",
+ "description": "Secret scanning was enabled for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repository_secret_scanning_generic_secrets.disabled",
+ "description": "Generic secrets have been disabled at the repository level",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_secret_scanning_generic_secrets.enabled",
+ "description": "Generic secrets have been enabled at the repository level",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repository_secret_scanning_non_provider_patterns.disabled",
+ "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
+ "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Supported secret scanning patterns"
+ },
+ {
+ "action": "repository_secret_scanning_non_provider_patterns.enabled",
+ "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
+ "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Supported secret scanning patterns"
+ },
+ {
+ "action": "repository_secret_scanning_push_protection_bypass_list.add",
+ "description": "A role or team was added to the push protection bypass list at the repository level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "repository_secret_scanning_push_protection_bypass_list.disable",
+ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "repository_secret_scanning_push_protection_bypass_list.enable",
+ "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "repository_secret_scanning_push_protection_bypass_list.remove",
+ "description": "A role or team was removed from the push protection bypass list at the repository level.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "repository_secret_scanning_push_protection.disable",
+ "description": "Secret scanning push protection was disabled for a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "repository_secret_scanning_push_protection.enable",
+ "description": "Secret scanning push protection was enabled for a repository.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "repository_security_configuration.applied",
+ "description": "A code security configuration was applied to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "repository_security_configuration_state",
+ "repository_security_configuration_failure_reason",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_security_configuration.failed",
+ "description": "A code security configuration failed to attach to the repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "repository_security_configuration_failure_reason",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_security_configuration.removed",
+ "description": "A code security configuration was removed from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "repository_security_configuration_state",
+ "repository_security_configuration_failure_reason",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_security_configuration.removed_by_settings_change",
+ "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "repository_security_configuration_state",
+ "repository_security_configuration_failure_reason",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_visibility_change.clear",
+ "description": "The repository visibility change setting was cleared for an organization or enterprise.",
+ "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility",
+ "fields": [
+ "created_at",
+ "_document_id",
+ "request_id",
+ "actor_id",
+ "business",
+ "action",
+ "operation_type",
+ "user",
+ "user_id",
+ "business_id",
+ "@timestamp",
+ "user_agent",
+ "actor",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise"
+ },
+ {
+ "action": "repository_visibility_change.disable",
+ "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "org_id",
+ "created_at",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "org",
+ "operation_type",
+ "_document_id",
+ "@timestamp",
+ "user_id",
+ "action",
+ "request_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_visibility_change.enable",
+ "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "operation_type",
+ "_document_id",
+ "@timestamp",
+ "user_agent",
+ "user",
+ "created_at",
+ "org",
+ "org_id",
+ "action",
+ "actor_id",
+ "user_id",
+ "request_id"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alert.auto_dismiss",
+ "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "alert_id",
+ "alert_number",
+ "ghsa_id",
+ "action",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "owner",
+ "org",
+ "org_id",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About Dependabot auto-triage rules"
+ },
+ {
+ "action": "repository_vulnerability_alert.auto_reopen",
+ "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "alert_id",
+ "alert_number",
+ "ghsa_id",
+ "action",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "owner",
+ "org",
+ "org_id",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About Dependabot auto-triage rules"
+ },
+ {
+ "action": "repository_vulnerability_alert.create",
+ "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
+ "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+ "fields": [
+ "operation_type",
+ "request_id",
+ "repo_id",
+ "@timestamp",
+ "user_agent",
+ "alert_id",
+ "action",
+ "repo",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "alert_number",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "About Dependabot alerts"
+ },
+ {
+ "action": "repository_vulnerability_alert.dismiss",
+ "description": "A Dependabot alert was manually dismissed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo_id",
+ "org_id",
+ "user_id",
+ "request_id",
+ "@timestamp",
+ "operation_type",
+ "user_agent",
+ "alert_id",
+ "actor",
+ "repo",
+ "created_at",
+ "org",
+ "_document_id",
+ "action",
+ "actor_id",
+ "dismiss_reason",
+ "user",
+ "dismiss_comment",
+ "alert_number",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alert.reintroduce",
+ "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "alert_id",
+ "created_at",
+ "action",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "owner",
+ "_document_id",
+ "@timestamp",
+ "operation_type",
+ "token_scopes",
+ "alert_number"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alert.reopen",
+ "description": "A Dependabot alert was manually reopened.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "alert_id",
+ "created_at",
+ "action",
+ "repo",
+ "repo_id",
+ "owner",
+ "org",
+ "org_id",
+ "_document_id",
+ "@timestamp",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo",
+ "alert_number",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alert.resolve",
+ "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "alert_id",
+ "repo",
+ "operation_type",
+ "action",
+ "repo_id",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "@timestamp",
+ "created_at",
+ "actor",
+ "actor_id",
+ "token_scopes",
+ "alert_number",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alert.withdraw",
+ "description": "A Dependabot alert was withdrawn.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "alert_id",
+ "alert_number",
+ "ghsa_id",
+ "created_at",
+ "active",
+ "action",
+ "repository_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "owner",
+ "org",
+ "org_id",
+ "_document_id",
+ "@timestamp",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alerts.authorized_users_teams",
+ "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
+ "fields": [
+ "org",
+ "_document_id",
+ "repo",
+ "org_id",
+ "operation_type",
+ "created_at",
+ "actor",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "repo_id",
+ "request_id",
+ "actor_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
+ },
+ {
+ "action": "repository_vulnerability_alerts_auto_dismissal.disable",
+ "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alerts_auto_dismissal.enable",
+ "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alerts.disable",
+ "description": "Dependabot alerts was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "request_id",
+ "repo_id",
+ "action",
+ "actor_id",
+ "@timestamp",
+ "created_at",
+ "actor",
+ "user_agent",
+ "org_id",
+ "user",
+ "org",
+ "_document_id",
+ "user_id",
+ "operation_type",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repository_vulnerability_alerts.enable",
+ "description": "Dependabot alerts was enabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "user_agent",
+ "created_at",
+ "@timestamp",
+ "repo_id",
+ "action",
+ "user",
+ "repo",
+ "org",
+ "org_id",
+ "actor_id",
+ "_document_id",
+ "user_id",
+ "operation_type",
+ "request_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "required_status_check.create",
+ "description": "A status check was marked as required for a protected branch.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
+ "fields": [
+ "org",
+ "actor_id",
+ "@timestamp",
+ "business",
+ "request_id",
+ "context",
+ "repo_id",
+ "action",
+ "repo",
+ "_document_id",
+ "operation_type",
+ "business_id",
+ "org_id",
+ "actor",
+ "created_at",
+ "user_agent",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
+ },
+ {
+ "action": "required_status_check.destroy",
+ "description": "A status check was no longer marked as required for a protected branch.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
+ "fields": [
+ "actor_id",
+ "actor",
+ "created_at",
+ "context",
+ "operation_type",
+ "@timestamp",
+ "request_id",
+ "org",
+ "user_agent",
+ "repo_id",
+ "org_id",
+ "action",
+ "_document_id",
+ "repo",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
+ },
+ {
+ "action": "restrict_notification_delivery.disable",
+ "description": "Email notification restrictions for an organization or enterprise were disabled.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "business",
+ "business_id",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
+ },
+ {
+ "action": "restrict_notification_delivery.enable",
+ "description": "Email notification restrictions for an organization or enterprise were enabled.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "business_id",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
+ },
+ {
+ "action": "role.create",
+ "description": "A new custom repository role was created.",
+ "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "name",
+ "owner",
+ "base_role",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "role_permissions",
+ "old_role_permissions"
+ ],
+ "docs_reference_titles": "Managing custom repository roles for an organization"
+ },
+ {
+ "action": "role.destroy",
+ "description": "A custom repository role was deleted.",
+ "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "name",
+ "owner",
+ "role_permissions",
+ "base_role",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Managing custom repository roles for an organization"
+ },
+ {
+ "action": "role.update",
+ "description": "A custom repository role was edited.",
+ "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "owner",
+ "role_permissions",
+ "base_role",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "old_role_permissions",
+ "old_base_role"
+ ],
+ "docs_reference_titles": "Managing custom repository roles for an organization"
+ },
+ {
+ "action": "secret_scanning_alert.assign",
+ "description": "A user was assigned to a secret scanning alert.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "created_at"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning_alert.create",
+ "description": "GitHub detected a secret and created a secret scanning alert.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning_alert.delete",
+ "description": "A secret scanning alert was deleted by GitHub.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "created_at",
+ "reason"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning_alert.public_leak",
+ "description": "A secret scanning alert was leaked in a public repo.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "created_at"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning_alert.reopen",
+ "description": "A secret scanning alert was reopened.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "number",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes",
+ "secret_type_display_name"
+ ]
+ },
+ {
+ "action": "secret_scanning_alert.report",
+ "description": "A leaked secret was reported to the secret's provider by secret scanning.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "secret_type",
+ "created_at",
+ "secret_type_display_name",
+ "secret_type_provider",
+ "report_result"
+ ],
+ "docs_reference_titles": "Resolving alerts from secret scanning"
+ },
+ {
+ "action": "secret_scanning_alert.resolve",
+ "description": "A secret scanning alert was resolved.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "number",
+ "resolution",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "secret_scanning_alert.revoke",
+ "description": "A secret scanning alert was revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "number",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "secret_scanning_alert.unassign",
+ "description": "A user was unassigned from a secret scanning alert.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "created_at"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning_alert.validate",
+ "description": "A secret scanning alert was validated.",
+ "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "created_at",
+ "previous_validity",
+ "current_validity",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo"
+ ],
+ "docs_reference_titles": "Manage secret scanning alerts"
+ },
+ {
+ "action": "secret_scanning_closure_request.approve",
+ "description": "A request to close a secret scanning alert was approved by a user.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "request_reviewer_comment",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "secret_scanning_closure_request.cancel",
+ "description": "N/A",
+ "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user."
+ },
+ {
+ "action": "secret_scanning_closure_request.create",
+ "description": "N/A",
+ "docs_reference_links": "A user requested to close a secret scanning alert.",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "reason",
+ "comment",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert."
+ },
+ {
+ "action": "secret_scanning_closure_request.deny",
+ "description": "A request to close a secret scanning alert was denied by a user.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "alert_number",
+ "request_reviewer_comment",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "secret_scanning.disable",
+ "description": "Secret scanning was disabled for all existing repositories.",
+ "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "About secret scanning"
+ },
+ {
+ "action": "secret_scanning.enable",
+ "description": "Secret scanning was enabled for all existing repositories.",
+ "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "About secret scanning"
+ },
+ {
+ "action": "secret_scanning_new_repos.disable",
+ "description": "Secret scanning was disabled for all new repositories.",
+ "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "About secret scanning"
+ },
+ {
+ "action": "secret_scanning_new_repos.enable",
+ "description": "Secret scanning was enabled for all new repositories.",
+ "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "About secret scanning"
+ },
+ {
+ "action": "secret_scanning_push_protection.bypass",
+ "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
+ "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
+ "fields": [
+ "repo_id",
+ "repo",
+ "actor_id",
+ "actor",
+ "org_id",
+ "org",
+ "business",
+ "business_id",
+ "number",
+ "created_at",
+ "push_protection_bypass_reason",
+ "secret_type",
+ "secret_type_display_name",
+ "publicly_leaked",
+ "multi_repo",
+ "request_reviewer",
+ "request_reviewer_id"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "secret_scanning_push_protection_request.approve",
+ "description": "A request to bypass secret scanning push protection was approved by a user.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "number",
+ "repository",
+ "repository_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "secret_scanning_push_protection_request.cancel",
+ "description": "A user canceled a request to bypass secret scanning push protection.",
+ "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "repository",
+ "repository_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
+ },
+ {
+ "action": "secret_scanning_push_protection_request.complete",
+ "description": "A user pushed a commit containing a secret for which there is an approved secret scanning push protection bypass request.",
+ "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "number",
+ "repository",
+ "repository_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
+ },
+ {
+ "action": "secret_scanning_push_protection_request.deny",
+ "description": "A request to bypass secret scanning push protection was denied by a user.",
+ "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "number",
+ "repository",
+ "repository_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header",
+ "request_reviewer_comment"
+ ],
+ "docs_reference_titles": "About push protection"
+ },
+ {
+ "action": "secret_scanning_push_protection_request.request",
+ "description": "A user requested to bypass secret scanning push protection.",
+ "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "number",
+ "repository",
+ "repository_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
+ },
+ {
+ "action": "secret_scanning_scan.completed",
+ "description": "A secret scanning scan has completed on this repository.",
+ "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+ "fields": [
+ "repo_id",
+ "org_id",
+ "business_id",
+ "source",
+ "type",
+ "source_slug",
+ "type_slug",
+ "started_at",
+ "completed_at",
+ "repo",
+ "public_repo",
+ "org",
+ "business",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "secret_types",
+ "custom_pattern_name",
+ "custom_pattern_scope"
+ ],
+ "docs_reference_titles": "About secret scanning"
+ },
+ {
+ "action": "security_configuration.create",
+ "description": "A security configuration was created",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "security_configuration_description",
+ "security_configuration_created_at",
+ "security_configuration_updated_at",
+ "security_configuration_enable_ghas",
+ "security_configuration_private_vulnerability_reporting",
+ "security_configuration_dependency_graph",
+ "security_configuration_dependabot_alerts",
+ "security_configuration_dependabot_security_updates",
+ "security_configuration_code_scanning",
+ "security_configuration_secret_scanning",
+ "security_configuration_secret_scanning_push_protection",
+ "security_configuration_secret_scanning_validity_checks",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "security_configuration_dependency_graph_autosubmit_action",
+ "security_configuration_secret_scanning_non_provider_patterns",
+ "security_configuration_secret_scanning_delegated_bypass",
+ "security_configuration_secret_scanning_generic_secrets",
+ "security_configuration_secret_scanning_delegated_alert_dismissal",
+ "security_configuration_code_scanning_delegated_alert_dismissal",
+ "security_configuration_code_security_sku_enabled",
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
+ ]
+ },
+ {
+ "action": "security_configuration_default.delete",
+ "description": "A default security configuration setting for new repositories was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "default_for_new_private_repos",
+ "default_for_new_public_repos",
+ "security_configuration_name",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "security_configuration_default.update",
+ "description": "A default security configuration setting for new repositories was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "default_for_new_private_repos",
+ "default_for_new_public_repos",
+ "security_configuration_name",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "security_configuration.delete",
+ "description": "A security configuration was deleted",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "security_configuration_description",
+ "security_configuration_created_at",
+ "security_configuration_updated_at",
+ "security_configuration_enable_ghas",
+ "security_configuration_private_vulnerability_reporting",
+ "security_configuration_dependency_graph",
+ "security_configuration_dependabot_alerts",
+ "security_configuration_dependabot_security_updates",
+ "security_configuration_code_scanning",
+ "security_configuration_secret_scanning",
+ "security_configuration_secret_scanning_push_protection",
+ "security_configuration_secret_scanning_validity_checks",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "security_configuration_dependency_graph_autosubmit_action",
+ "security_configuration_secret_scanning_non_provider_patterns",
+ "security_configuration_secret_scanning_delegated_bypass",
+ "security_configuration_secret_scanning_delegated_alert_dismissal",
+ "security_configuration_code_scanning_delegated_alert_dismissal",
+ "security_configuration_code_security_sku_enabled",
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
+ ]
+ },
+ {
+ "action": "security_configuration_policy.update",
+ "description": "A security configuration policy was updated",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "enforcement",
+ "security_configuration_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "security_configuration.update",
+ "description": "A security configuration was updated",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "security_configuration_id",
+ "security_configuration_name",
+ "security_configuration_description",
+ "security_configuration_created_at",
+ "security_configuration_updated_at",
+ "security_configuration_enable_ghas",
+ "security_configuration_private_vulnerability_reporting",
+ "security_configuration_dependency_graph",
+ "security_configuration_dependabot_alerts",
+ "security_configuration_dependabot_security_updates",
+ "security_configuration_code_scanning",
+ "security_configuration_secret_scanning",
+ "security_configuration_secret_scanning_push_protection",
+ "security_configuration_secret_scanning_validity_checks",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "security_configuration_dependency_graph_autosubmit_action",
+ "security_configuration_secret_scanning_non_provider_patterns",
+ "security_configuration_secret_scanning_delegated_bypass",
+ "security_configuration_secret_scanning_generic_secrets",
+ "security_configuration_secret_scanning_delegated_alert_dismissal",
+ "security_configuration_code_scanning_delegated_alert_dismissal",
+ "security_configuration_code_security_sku_enabled",
+ "security_configuration_secret_protection_sku_enabled",
+ "security_configuration_dependabot_delegated_alert_dismissal"
+ ]
+ },
+ {
+ "action": "sponsors.agreement_sign",
+ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.custom_amount_settings_change",
+ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "sponsors_listing_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
+ },
+ {
+ "action": "sponsors.fiscal_host_change",
+ "description": "The fiscal host for a GitHub Sponsors listing was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "sponsors_listing_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.invoiced_agreement_sign",
+ "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
+ "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org_id",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice"
+ },
+ {
+ "action": "sponsors.repo_funding_links_file_action",
+ "description": "The FUNDING file in a repository was changed.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
+ "fields": [
+ "@timestamp",
+ "action",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "repository",
+ "repository_id",
+ "actor",
+ "user_agent",
+ "actor_id",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_cancel",
+ "description": "A sponsorship was canceled.",
+ "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
+ "fields": [
+ "operation_type",
+ "_document_id",
+ "created_at",
+ "actor",
+ "user",
+ "action",
+ "actor_id",
+ "user_id",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Downgrading a sponsorship"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_create",
+ "description": "A sponsorship was created, by sponsoring an account.",
+ "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
+ "fields": [
+ "actor",
+ "user_id",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "user",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_payment_complete",
+ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
+ "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
+ "fields": [
+ "active",
+ "user",
+ "user_id",
+ "actor",
+ "actor_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_preference_change",
+ "description": "The option to receive email updates from a sponsored account was changed.",
+ "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
+ "fields": [
+ "actor_id",
+ "action",
+ "@timestamp",
+ "request_id",
+ "user_id",
+ "created_at",
+ "user",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_tier_change",
+ "description": "A sponsorship was upgraded or downgraded.",
+ "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
+ "fields": [
+ "user_id",
+ "actor",
+ "actor_id",
+ "action",
+ "user",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "created_at"
+ ],
+ "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
+ },
+ {
+ "action": "sponsors.sponsored_developer_approve",
+ "description": "A GitHub Sponsors account was approved.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
+ "fields": [
+ "user_id",
+ "action",
+ "user_agent",
+ "request_id",
+ "actor",
+ "user",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "actor_id",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+ },
+ {
+ "action": "sponsors.sponsored_developer_create",
+ "description": "A GitHub Sponsors account was created.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
+ "fields": [
+ "user_id",
+ "operation_type",
+ "request_id",
+ "actor_id",
+ "@timestamp",
+ "_document_id",
+ "user",
+ "action",
+ "created_at",
+ "user_agent",
+ "actor"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+ },
+ {
+ "action": "sponsors.sponsored_developer_disable",
+ "description": "A GitHub Sponsors account was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "sponsors.sponsored_developer_profile_update",
+ "description": "The profile for GitHub Sponsors account was edited.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
+ "fields": [
+ "@timestamp",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "request_id",
+ "actor",
+ "action",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
+ },
+ {
+ "action": "sponsors.sponsored_developer_redraft",
+ "description": "A GitHub Sponsors account was returned to draft state from approved state.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "created_at",
+ "request_id",
+ "user",
+ "action",
+ "user_agent",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "user_id"
+ ]
+ },
+ {
+ "action": "sponsors.sponsored_developer_request_approval",
+ "description": "An application for GitHub Sponsors was submitted for approval.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
+ "fields": [
+ "user_agent",
+ "user",
+ "@timestamp",
+ "actor_id",
+ "user_id",
+ "request_id",
+ "_document_id",
+ "actor",
+ "action",
+ "operation_type",
+ "created_at"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+ },
+ {
+ "action": "sponsors.sponsored_developer_tier_description_update",
+ "description": "The description for a sponsorship tier was changed.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
+ "fields": [
+ "operation_type",
+ "request_id",
+ "actor",
+ "user_id",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "user",
+ "created_at"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
+ },
+ {
+ "action": "sponsors.sponsors_patreon_user_create",
+ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "patreon_email",
+ "patreon_username",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account"
+ },
+ {
+ "action": "sponsors.sponsors_patreon_user_destroy",
+ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
+ "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "patreon_email",
+ "patreon_username",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Unlinking your Patreon account from GitHub"
+ },
+ {
+ "action": "sponsors.update_tier_repository",
+ "description": "A GitHub Sponsors tier changed access for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "repo",
+ "repo_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.update_tier_welcome_message",
+ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.withdraw_agreement_signature",
+ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "ssh_certificate_authority.create",
+ "description": "An SSH certificate authority for an organization or enterprise was created.",
+ "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
+ "fields": [
+ "@timestamp",
+ "_document_id",
+ "fingerprint",
+ "operation_type",
+ "openssh_public_key",
+ "org_id",
+ "actor",
+ "created_at",
+ "org",
+ "action",
+ "user_agent",
+ "actor_id",
+ "request_id"
+ ],
+ "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
+ },
+ {
+ "action": "ssh_certificate_authority.destroy",
+ "description": "An SSH certificate authority for an organization or enterprise was deleted.",
+ "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
+ "fields": [
+ "created_at",
+ "_document_id",
+ "fingerprint",
+ "operation_type",
+ "actor",
+ "org_id",
+ "openssh_public_key",
+ "org",
+ "action",
+ "user_agent",
+ "actor_id",
+ "@timestamp",
+ "request_id"
+ ],
+ "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
+ },
+ {
+ "action": "ssh_certificate_requirement.disable",
+ "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
+ "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
+ "fields": [
+ "user",
+ "user_agent",
+ "operation_type",
+ "_document_id",
+ "request_id",
+ "org",
+ "org_id",
+ "created_at",
+ "actor",
+ "action",
+ "user_id",
+ "business",
+ "business_id",
+ "@timestamp",
+ "actor_id"
+ ],
+ "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
+ },
+ {
+ "action": "ssh_certificate_requirement.enable",
+ "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
+ "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
+ "fields": [
+ "actor_id",
+ "user_id",
+ "org",
+ "operation_type",
+ "request_id",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "user",
+ "action",
+ "org_id",
+ "created_at",
+ "user_agent"
+ ],
+ "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
+ },
+ {
+ "action": "staff.dependabot_debug_credentials_generated",
+ "description": "Dependabot encrypted config was read.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo"
+ ]
+ },
+ {
+ "action": "staff.set_domain_token_expiration",
+ "description": "The verification code expiry time for an organization or enterprise domain was set.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner_type",
+ "domain_name",
+ "business_id",
+ "token_expires_at",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "staff.unverify_domain",
+ "description": "An organization or enterprise domain was unverified.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "owner_type",
+ "domain_name",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "staff.verify_domain",
+ "description": "An organization or enterprise domain was verified.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "domain_name",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "sub_issues.parent_issue_add",
+ "description": "A parent issue was added to an issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "sub_issues.parent_issue_remove",
+ "description": "A parent issue was removed from an issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "sub_issues.sub_issue_add",
+ "description": "A sub-issue was added to an issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "sub_issues.sub_issue_remove",
+ "description": "A sub-issue was removed from an issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "team.add_member",
+ "description": "A member of an organization was added to a team.",
+ "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "org_id",
+ "user_id",
+ "team",
+ "user",
+ "@timestamp",
+ "actor_id",
+ "created_at",
+ "operation_type",
+ "_document_id",
+ "org",
+ "action",
+ "actor",
+ "programmatic_access_type",
+ "team_type"
+ ],
+ "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
+ },
+ {
+ "action": "team.add_repository",
+ "description": "A team was given access and permissions to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "team",
+ "action",
+ "operation_type",
+ "request_id",
+ "created_at",
+ "@timestamp",
+ "org",
+ "repo",
+ "actor_id",
+ "_document_id",
+ "repo_id",
+ "user_agent",
+ "org_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "team.add_to_organization",
+ "description": "A team was added to an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "team_type",
+ "team",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "team.change_parent_team",
+ "description": "A child team was created or a child team's parent was changed.",
+ "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
+ "fields": [
+ "org",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "team",
+ "action",
+ "operation_type",
+ "actor",
+ "request_id",
+ "actor_id",
+ "user_agent",
+ "org_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
+ },
+ {
+ "action": "team.change_privacy",
+ "description": "A team's privacy level was changed.",
+ "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "org",
+ "action",
+ "team",
+ "created_at",
+ "operation_type",
+ "actor_id",
+ "org_id",
+ "@timestamp",
+ "actor",
+ "_document_id",
+ "team_type"
+ ],
+ "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
+ },
+ {
+ "action": "team.create",
+ "description": "A new team is created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "oauth_application_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "org_id",
+ "user_agent",
+ "team",
+ "org",
+ "actor",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "team_type"
+ ]
+ },
+ {
+ "action": "team.demote_maintainer",
+ "description": "A user was demoted from a team maintainer to a team member.",
+ "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "team",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
+ },
+ {
+ "action": "team.destroy",
+ "description": "A team was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "org",
+ "team",
+ "org_id",
+ "actor_id",
+ "actor",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "operation_type",
+ "_document_id",
+ "programmatic_access_type",
+ "team_type"
+ ]
+ },
+ {
+ "action": "team_discussions.clear",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "business_id",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "user",
+ "business",
+ "action",
+ "request_id",
+ "created_at",
+ "user_id",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "team_discussions.disable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org_id",
+ "action",
+ "operation_type",
+ "request_id",
+ "actor",
+ "org",
+ "created_at",
+ "actor_id",
+ "user",
+ "user_id",
+ "@timestamp",
+ "user_agent",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "team_discussions.enable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "@timestamp",
+ "action",
+ "_document_id",
+ "user_agent",
+ "user_id",
+ "business_id",
+ "request_id",
+ "user",
+ "business",
+ "operation_type",
+ "actor",
+ "created_at"
+ ]
+ },
+ {
+ "action": "team_group_mapping.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "actor",
+ "action",
+ "operation_type",
+ "team",
+ "@timestamp",
+ "actor_id",
+ "org",
+ "_document_id",
+ "org_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "team_group_mapping.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "@timestamp",
+ "actor_id",
+ "_document_id",
+ "team",
+ "created_at",
+ "org_id",
+ "action",
+ "request_id",
+ "user_agent",
+ "actor",
+ "org",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "team_group_mapping.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "team",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "team.promote_maintainer",
+ "description": "A user was promoted from a team member to a team maintainer.",
+ "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "team",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
+ },
+ {
+ "action": "team.remove_from_organization",
+ "description": "A team was removed from an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "team_type",
+ "team",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "team.remove_member",
+ "description": "An organization member was removed from a team.",
+ "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
+ "fields": [
+ "request_id",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "org",
+ "org_id",
+ "team",
+ "user_id",
+ "actor",
+ "user",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "team_type"
+ ],
+ "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
+ },
+ {
+ "action": "team.remove_repository",
+ "description": "A repository was removed from a team's control.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "org_id",
+ "repo",
+ "repo_id",
+ "action",
+ "_document_id",
+ "actor",
+ "@timestamp",
+ "actor_id",
+ "user_agent",
+ "created_at",
+ "team",
+ "org",
+ "operation_type",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "team.rename",
+ "description": "A team's name was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "name",
+ "user_agent",
+ "created_at",
+ "team",
+ "operation_type",
+ "actor_id",
+ "org",
+ "action",
+ "request_id",
+ "actor",
+ "org_id",
+ "@timestamp",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header",
+ "team_type"
+ ]
+ },
+ {
+ "action": "team_sync_tenant.disabled",
+ "description": "Team synchronization with a tenant was disabled.",
+ "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
+ "fields": [
+ "action",
+ "created_at",
+ "actor",
+ "request_id",
+ "org_id",
+ "actor_id",
+ "operation_type",
+ "_document_id",
+ "@timestamp",
+ "org",
+ "user_agent"
+ ],
+ "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
+ },
+ {
+ "action": "team_sync_tenant.enabled",
+ "description": "Team synchronization with a tenant was enabled.",
+ "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
+ "fields": [
+ "org_id",
+ "business_id",
+ "actor",
+ "created_at",
+ "user_agent",
+ "@timestamp",
+ "operation_type",
+ "business",
+ "actor_id",
+ "org",
+ "request_id",
+ "action",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
+ },
+ {
+ "action": "team_sync_tenant.update_okta_credentials",
+ "description": "The Okta credentials for team synchronization with a tenant were changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "team.update_repository_permission",
+ "description": "A team's permission to a repository was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "team",
+ "org_id",
+ "@timestamp",
+ "org",
+ "_document_id",
+ "old_permission",
+ "request_id",
+ "repo",
+ "action",
+ "repo_id",
+ "actor",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "permission",
+ "new_repo_permission",
+ "new_repo_base_role",
+ "old_repo_permission",
+ "old_repo_base_role",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "user_content_edit.delete",
+ "description": "Triggered when a user content edit is deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor",
+ "user_content_id",
+ "user_content_type",
+ "created_at",
+ "user_agent",
+ "deleted_by",
+ "editor_id",
+ "_document_id",
+ "deleted_at",
+ "action",
+ "actor_id",
+ "editor",
+ "deleted_by_id",
+ "deleted_content",
+ "operation_type",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.create",
+ "description": "A Dependabot rule was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.delete",
+ "description": "A Dependabot rule was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.disable",
+ "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.enable",
+ "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.force_disable",
+ "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "action",
+ "org",
+ "org_id",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.force_enable",
+ "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "action",
+ "org",
+ "org_id",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "vulnerability_alert_rule.update",
+ "description": "A Dependabot rule's conditions, actions, or metadata changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "vulnerability_alert_rule_id",
+ "vulnerability_alert_rule_name",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "workflows.approve_workflow_job",
+ "description": "A workflow job was approved.",
+ "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "workflow_run_id",
+ "run_number",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Reviewing deployments"
+ },
+ {
+ "action": "workflows.bypass_protection_rules",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "workflow_run_id",
+ "run_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "workflows.cancel_workflow_run",
+ "description": "A workflow run was cancelled.",
+ "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "started_at",
+ "event",
+ "name",
+ "workflow_run_id",
+ "head_branch",
+ "head_sha",
+ "run_number",
+ "cancelled_at",
+ "workflow_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "business",
+ "business_id",
+ "trigger_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Canceling a workflow run"
+ },
+ {
+ "action": "workflows.comment_workflow_job",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "token_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "workflow_run_id",
+ "run_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "workflows.completed_workflow_run",
+ "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "started_at",
+ "event",
+ "name",
+ "workflow_run_id",
+ "head_branch",
+ "head_sha",
+ "completed_at",
+ "conclusion",
+ "run_number",
+ "workflow_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "business",
+ "business_id",
+ "trigger_id",
+ "run_attempt",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "Viewing workflow run history"
+ },
+ {
+ "action": "workflows.created_workflow_run",
+ "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "started_at",
+ "event",
+ "name",
+ "workflow_run_id",
+ "head_branch",
+ "head_sha",
+ "workflow_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "business",
+ "business_id",
+ "trigger_id",
+ "public_repo",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header",
+ "actor_is_agent"
+ ],
+ "docs_reference_titles": "Understanding GitHub Actions"
+ },
+ {
+ "action": "workflows.delete_workflow_run",
+ "description": "A workflow run was deleted.",
+ "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "workflow_run_id",
+ "started_at",
+ "head_branch",
+ "head_sha",
+ "trigger_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Deleting a workflow run"
+ },
+ {
+ "action": "workflows.disable_workflow",
+ "description": "A workflow was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "workflow_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "workflows.enable_workflow",
+ "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "workflow_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "workflows.pin_workflow",
+ "description": "A workflow was pinned.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "workflow_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "workflows.prepared_workflow_job",
+ "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+ "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
+ "fields": [
+ "repo_id",
+ "repo",
+ "org_id",
+ "org",
+ "business_id",
+ "business",
+ "workflow_run_id",
+ "job_name",
+ "runner_labels",
+ "is_hosted_runner",
+ "environment_name",
+ "secrets_passed",
+ "action",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "@timestamp",
+ "runner_owner_type",
+ "job_workflow_ref",
+ "calling_workflow_refs",
+ "calling_workflow_shas",
+ "imposer_repo"
+ ],
+ "docs_reference_titles": "Events that trigger workflows"
+ },
+ {
+ "action": "workflows.reject_workflow_job",
+ "description": "A workflow job was rejected.",
+ "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "workflow_run_id",
+ "run_number",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Reviewing deployments"
+ },
+ {
+ "action": "workflows.rerun_workflow_run",
+ "description": "A workflow run was re-run.",
+ "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "started_at",
+ "event",
+ "name",
+ "workflow_run_id",
+ "head_branch",
+ "head_sha",
+ "run_number",
+ "workflow_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "business",
+ "business_id",
+ "trigger_id",
+ "run_attempt",
+ "rerun_type",
+ "check_run_id",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Re-running workflows and jobs"
+ },
+ {
+ "action": "workflows.unpin_workflow",
+ "description": "A workflow was unpinned after previously being pinned.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "workflow_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ }
+]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.20/user.json b/src/audit-logs/data/ghes-3.20/user.json
new file mode 100644
index 000000000000..d3296f6f9bf4
--- /dev/null
+++ b/src/audit-logs/data/ghes-3.20/user.json
@@ -0,0 +1,9103 @@
+[
+ {
+ "action": "account.billing_date_change",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "@timestamp",
+ "operation_type",
+ "user_agent",
+ "_document_id",
+ "created_at",
+ "action",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org_id"
+ ]
+ },
+ {
+ "action": "account.plan_change",
+ "description": "The account's plan changed.",
+ "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
+ "fields": [
+ "actor",
+ "operation_type",
+ "_document_id",
+ "user_agent",
+ "created_at",
+ "actor_id",
+ "request_id",
+ "@timestamp",
+ "user",
+ "action",
+ "user_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "How GitHub billing works"
+ },
+ {
+ "action": "account_recovery_token.confirm",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "created_at",
+ "_document_id",
+ "token_id",
+ "user_id",
+ "user",
+ "actor",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "account_recovery_token.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "created_at",
+ "token_id",
+ "user",
+ "request_id",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "user_id",
+ "actor_id",
+ "operation_type",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "account_recovery_token.recover",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "@timestamp",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "actor",
+ "user_agent",
+ "request_id",
+ "action",
+ "_document_id",
+ "user_id",
+ "token_id"
+ ]
+ },
+ {
+ "action": "actions_cache.delete",
+ "description": "A GitHub Actions cache was deleted using the REST API.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "user_id",
+ "user",
+ "repo_id",
+ "repo",
+ "org",
+ "org_id",
+ "actions_cache_id",
+ "actions_cache_key",
+ "actions_cache_version",
+ "actions_cache_scope",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "artifact.destroy",
+ "description": "A workflow run artifact was manually deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "actor",
+ "user_agent",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "request_id",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "operation_type",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "billing.budget_create",
+ "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "customer_id",
+ "target_amount",
+ "target_type",
+ "target_id",
+ "alert_enabled",
+ "status",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "pricing_target_type",
+ "pricing_target_id",
+ "budget_limit_type",
+ "alert_recipient_user_ids",
+ "exclude_cost_center_usage"
+ ]
+ },
+ {
+ "action": "billing.budget_delete",
+ "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "customer_id",
+ "uuid",
+ "status",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "billing.budget_update",
+ "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "customer_id",
+ "target_amount",
+ "target_type",
+ "target_id",
+ "alert_enabled",
+ "status",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header",
+ "old_target_amount",
+ "old_budget_limit_type",
+ "old_alert_enabled",
+ "old_target_id",
+ "old_pricing_target_type",
+ "old_pricing_target_id"
+ ]
+ },
+ {
+ "action": "billing.change_billing_type",
+ "description": "The way the account pays for GitHub was changed.",
+ "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
+ "fields": [
+ "actor_id",
+ "user",
+ "@timestamp",
+ "actor",
+ "user_id",
+ "action",
+ "created_at",
+ "operation_type",
+ "_document_id",
+ "user_agent",
+ "request_id"
+ ],
+ "docs_reference_titles": "Managing your payment and billing information"
+ },
+ {
+ "action": "billing.change_email",
+ "description": "The billing email address changed.",
+ "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
+ "fields": [
+ "actor",
+ "operation_type",
+ "actor_id",
+ "org_id",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "created_at",
+ "_document_id",
+ "org",
+ "email",
+ "action",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing your payment and billing information"
+ },
+ {
+ "action": "billing_customer.azure_subscription_linked",
+ "description": "Azure subscription has been linked on this account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "billing_customer.azure_subscription_unlinked",
+ "description": "Azure subscription has been unlinked on this account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "billing.lock",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "oauth_application_id",
+ "@timestamp",
+ "actor_id",
+ "operation_type",
+ "_document_id",
+ "request_id",
+ "actor",
+ "user",
+ "user_id",
+ "user_agent",
+ "created_at",
+ "action"
+ ]
+ },
+ {
+ "action": "billing.overage_policy_updated",
+ "description": "The premium request paid usage policy for your GitHub account was changed.",
+ "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage"
+ },
+ {
+ "action": "billing.unlock",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user",
+ "operation_type",
+ "user_agent",
+ "created_at",
+ "user_id",
+ "request_id",
+ "actor",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "billing.update_bill_cycle_day",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "business.security_center_export_code_scanning_metrics",
+ "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "start_date",
+ "end_date",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business.security_center_export_coverage",
+ "description": "A CSV export was requested on the \"Coverage\" page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business.security_center_export_overview_dashboard",
+ "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "start_date",
+ "end_date",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "business.security_center_export_risk",
+ "description": "A CSV export was requested on the \"Risk\" page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "business_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "business.set_actions_cache_retention_policy",
+ "description": "The cache retention policy for GitHub Actions was set for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "name",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_actions_cache_storage_policy",
+ "description": "The cache storage policy for GitHub Actions was set for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "name",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_actions_fork_pr_approvals_policy",
+ "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "policy",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_actions_private_fork_pr_approvals_policy",
+ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "policy",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_actions_retention_limit",
+ "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "limit",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_default_workflow_permissions",
+ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_fork_pr_workflows_policy",
+ "description": "The policy for fork pull request workflows was changed for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "policy",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "business.set_workflow_permission_can_approve_pr",
+ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
+ "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+ },
+ {
+ "action": "checks.auto_trigger_disabled",
+ "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
+ "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
+ "fields": [
+ "visibility",
+ "user_agent",
+ "user",
+ "@timestamp",
+ "repo",
+ "actor_id",
+ "user_id",
+ "action",
+ "created_at",
+ "actor",
+ "operation_type",
+ "request_id",
+ "repo_id",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
+ },
+ {
+ "action": "checks.auto_trigger_enabled",
+ "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
+ "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo"
+ ],
+ "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
+ },
+ {
+ "action": "checks.delete_logs",
+ "description": "Logs in a check suite were deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "actor",
+ "actor_id",
+ "operation_type",
+ "repo_id",
+ "action",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "codespaces.allow_permissions",
+ "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "origin_repository",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "codespaces.connect",
+ "description": "Credentials for a codespace were refreshed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repository_id",
+ "repository",
+ "pull_request_id",
+ "user_id",
+ "org_id",
+ "owner",
+ "name",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "machine_type",
+ "devcontainer_path"
+ ]
+ },
+ {
+ "action": "codespaces.create",
+ "description": "A codespace was created",
+ "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repository_id",
+ "repository",
+ "pull_request_id",
+ "owner",
+ "name",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "machine_type",
+ "devcontainer_path"
+ ],
+ "docs_reference_titles": "Creating a codespace for a repository"
+ },
+ {
+ "action": "codespaces.destroy",
+ "description": "A user deleted a codespace.",
+ "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repository_id",
+ "repository",
+ "pull_request_id",
+ "owner",
+ "name",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Deleting a codespace"
+ },
+ {
+ "action": "codespaces.export_environment",
+ "description": "A codespace was exported to a branch on GitHub.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "owner",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo"
+ ]
+ },
+ {
+ "action": "codespaces.restore",
+ "description": "A codespace was restored.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "codespaces.start_environment",
+ "description": "A codespace was started.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "org",
+ "owner",
+ "pull_request_id",
+ "machine_type",
+ "user_id",
+ "user",
+ "devcontainer_path",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "codespaces.suspend_environment",
+ "description": "A codespace was stopped.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "codespaces.trusted_repositories_access_update",
+ "description": "A personal account's access and security setting for Codespaces were updated.",
+ "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "business",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Managing access to other repositories within your codespace"
+ },
+ {
+ "action": "copilot.cfb_seat_added",
+ "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "token_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_assignment_created",
+ "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
+ "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "What is GitHub Copilot?"
+ },
+ {
+ "action": "copilot.cfb_seat_assignment_refreshed",
+ "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "token_id",
+ "token_scopes",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_assignment_reused",
+ "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_assignment_unassigned",
+ "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_cancelled",
+ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "seat_assignment",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "copilot.cfb_seat_cancelled_by_staff",
+ "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user_id",
+ "user",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "copilot.swe_agent_repo_disabled",
+ "description": "Specific repositories were disabled from using Copilot coding agent.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "org_id",
+ "owner_type",
+ "actor_id",
+ "owner",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "copilot.swe_agent_repo_enabled",
+ "description": "Specific repositories were enabled to use Copilot coding agent.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "org_id",
+ "owner_type",
+ "owner",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "copilot.swe_agent_repo_enablement_updated",
+ "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "new_access",
+ "old_access",
+ "org_id",
+ "owner_type",
+ "owner",
+ "org",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "custom_hosted_runner.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "runner_group_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "custom_hosted_runner.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "custom_hosted_runner.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "runner_group_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "dependabot_alerts.disable",
+ "description": "Dependabot alerts were disabled for all existing repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
+ },
+ {
+ "action": "dependabot_alerts.enable",
+ "description": "Dependabot alerts were enabled for all existing repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
+ },
+ {
+ "action": "dependabot_alerts_new_repos.disable",
+ "description": "Dependabot alerts were disabled for all new repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
+ },
+ {
+ "action": "dependabot_alerts_new_repos.enable",
+ "description": "Dependabot alerts were enabled for all new repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
+ },
+ {
+ "action": "dependabot_repository_access.repositories_updated",
+ "description": "The repositories that Dependabot can access were updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "dependabot_security_updates.disable",
+ "description": "Dependabot security updates were disabled for all existing repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+ },
+ {
+ "action": "dependabot_security_updates.enable",
+ "description": "Dependabot security updates were enabled for all existing repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "dependabot_security_updates_new_repos.disable",
+ "description": " Dependabot security updates were disabled for all new repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+ },
+ {
+ "action": "dependabot_security_updates_new_repos.enable",
+ "description": "Dependabot security updates were enabled for all new repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "dependency_graph.disable",
+ "description": "The dependency graph was disabled for all existing repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+ },
+ {
+ "action": "dependency_graph.enable",
+ "description": "The dependency graph was enabled for all existing repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "dependency_graph_new_repos.disable",
+ "description": "The dependency graph was disabled for all new repositories.",
+ "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+ },
+ {
+ "action": "dependency_graph_new_repos.enable",
+ "description": "The dependency graph was enabled for all new repositories.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "environment.add_protection_rule",
+ "description": "A GitHub Actions deployment protection rule was created via the API.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "environment_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "environment.create_actions_secret",
+ "description": "A secret was created for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "key",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.create_actions_variable",
+ "description": "A variable was created for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "environment_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "environment.delete",
+ "description": "An environment was deleted.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.remove_actions_secret",
+ "description": "A secret was deleted for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "key",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "public_repo",
+ "token_scopes",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.remove_actions_variable",
+ "description": "A variable was deleted for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "environment_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "environment.remove_protection_rule",
+ "description": "A GitHub Actions deployment protection rule was deleted via the API.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.update_actions_secret",
+ "description": "A secret was updated for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "key",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "environment.update_actions_variable",
+ "description": "A variable was updated for a GitHub Actions environment.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "environment_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "environment.update_protection_rule",
+ "description": "A GitHub Actions deployment protection rule was updated via the API.",
+ "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "new_value",
+ "approvers_was",
+ "approvers",
+ "programmatic_access_type",
+ "can_admins_bypass",
+ "prevent_self_review"
+ ],
+ "docs_reference_titles": "Managing environments for deployment"
+ },
+ {
+ "action": "gist.create",
+ "description": "A gist was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "user_id",
+ "user",
+ "gist_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "visibility",
+ "action",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "gist.destroy",
+ "description": "A gist was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "gist_id",
+ "visibility",
+ "created_at",
+ "_document_id",
+ "user",
+ "request_id",
+ "operation_type",
+ "actor",
+ "actor_id",
+ "action",
+ "user_agent",
+ "@timestamp",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "gist.visibility_change",
+ "description": "The visibility of a gist was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "actor",
+ "user",
+ "gist_id",
+ "actor_id",
+ "request_id",
+ "visibility",
+ "user_id",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "git_signing_ssh_public_key.create",
+ "description": "An SSH key was added to a user account as a Git commit signing key.",
+ "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "key",
+ "fingerprint",
+ "user_id",
+ "user",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
+ },
+ {
+ "action": "git_signing_ssh_public_key.delete",
+ "description": "An SSH key was removed from a user account as a Git commit signing key.",
+ "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "key",
+ "fingerprint",
+ "user_id",
+ "explanation",
+ "user",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
+ },
+ {
+ "action": "github_hosted_runner.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "runner_group_id",
+ "business",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "github_hosted_runner.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "business",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "github_hosted_runner.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "runner_group_id",
+ "business",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "gpg_key.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "created_at",
+ "user_id",
+ "@timestamp",
+ "user",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "action",
+ "user_agent",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "gpg_key.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "operation_type",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "action",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "@timestamp",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "hook.active_changed",
+ "description": "A hook's active status was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "name",
+ "events",
+ "active",
+ "active_was",
+ "hook_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "hook.config_changed",
+ "description": "A hook's configuration was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "name",
+ "org",
+ "user_agent",
+ "request_id",
+ "hook_id",
+ "repo",
+ "repo_id",
+ "created_at",
+ "oauth_application_id",
+ "action",
+ "events",
+ "org_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "hook.create",
+ "description": "A new hook was added.",
+ "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
+ "fields": [
+ "oauth_application",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "repo_id",
+ "request_id",
+ "hook_id",
+ "events",
+ "repo",
+ "@timestamp",
+ "operation_type",
+ "name",
+ "action",
+ "created_at",
+ "org_id",
+ "org",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "About webhooks"
+ },
+ {
+ "action": "hook.destroy",
+ "description": "A hook was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "events",
+ "repo",
+ "created_at",
+ "org",
+ "name",
+ "request_id",
+ "actor_id",
+ "repo_id",
+ "org_id",
+ "action",
+ "operation_type",
+ "oauth_application_id",
+ "user_agent",
+ "hook_id",
+ "@timestamp",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "hook.events_changed",
+ "description": "A hook's configured events were changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "events",
+ "repo",
+ "operation_type",
+ "action",
+ "_document_id",
+ "actor_id",
+ "name",
+ "events_were",
+ "@timestamp",
+ "created_at",
+ "hook_id",
+ "repo_id",
+ "org_id",
+ "org",
+ "user_agent",
+ "request_id",
+ "oauth_application_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "integration.create",
+ "description": "A GitHub App was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "actor",
+ "user_agent",
+ "actor_id",
+ "request_id",
+ "name",
+ "user_id",
+ "_document_id",
+ "integration",
+ "created_at",
+ "programmatic_access_type",
+ "request_access_security_header",
+ "application_client_id"
+ ]
+ },
+ {
+ "action": "integration.destroy",
+ "description": "A GitHub App was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "user_id",
+ "actor_id",
+ "request_id",
+ "@timestamp",
+ "name",
+ "integration",
+ "user",
+ "_document_id",
+ "action",
+ "operation_type",
+ "created_at",
+ "user_agent"
+ ]
+ },
+ {
+ "action": "integration.generate_client_secret",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "integration",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header",
+ "application_client_id"
+ ]
+ },
+ {
+ "action": "integration_installation.create",
+ "description": "A GitHub App was installed.",
+ "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
+ "fields": [
+ "operation_type",
+ "@timestamp",
+ "name",
+ "request_id",
+ "repository_selection",
+ "user_id",
+ "action",
+ "user_agent",
+ "user",
+ "created_at",
+ "integration",
+ "_document_id",
+ "programmatic_access_type",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
+ },
+ {
+ "action": "integration_installation.destroy",
+ "description": "A GitHub App was uninstalled.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
+ "fields": [
+ "@timestamp",
+ "request_id",
+ "actor",
+ "created_at",
+ "_document_id",
+ "repository_selection",
+ "integration",
+ "user_id",
+ "user",
+ "action",
+ "operation_type",
+ "name",
+ "actor_id",
+ "user_agent",
+ "programmatic_access_type",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
+ },
+ {
+ "action": "integration_installation.repositories_added",
+ "description": "Repositories were added to a GitHub App.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
+ "fields": [
+ "user_id",
+ "repository_selection",
+ "name",
+ "user",
+ "request_id",
+ "integration",
+ "operation_type",
+ "actor_id",
+ "action",
+ "repositories_added",
+ "created_at",
+ "_document_id",
+ "@timestamp",
+ "actor",
+ "user_agent",
+ "token_scopes",
+ "repositories_added_names",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
+ },
+ {
+ "action": "integration_installation.repositories_removed",
+ "description": "Repositories were removed from a GitHub App.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
+ "fields": [
+ "user",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "repository_selection",
+ "repositories_removed",
+ "integration",
+ "user_id",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "@timestamp",
+ "name",
+ "action",
+ "actor_id",
+ "repositories_removed_names",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
+ },
+ {
+ "action": "integration_installation.suspend",
+ "description": "A GitHub App was suspended.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "name",
+ "repository_selection",
+ "actor_id",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
+ },
+ {
+ "action": "integration_installation.unsuspend",
+ "description": "A GitHub App was unsuspended.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "name",
+ "repository_selection",
+ "actor_id",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
+ },
+ {
+ "action": "integration_installation.version_updated",
+ "description": "Permissions for a GitHub App were updated.",
+ "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
+ "fields": [
+ "integration",
+ "user_id",
+ "user_agent",
+ "name",
+ "user",
+ "operation_type",
+ "actor_id",
+ "action",
+ "_document_id",
+ "request_id",
+ "created_at",
+ "repository_selection",
+ "@timestamp",
+ "actor",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
+ },
+ {
+ "action": "integration.manager_added",
+ "description": "A member of an enterprise or organization was added as a GitHub App manager.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
+ "fields": [
+ "created_at",
+ "action",
+ "_document_id",
+ "name",
+ "org_id",
+ "manager",
+ "operation_type",
+ "actor",
+ "integration",
+ "org",
+ "@timestamp",
+ "actor_id",
+ "request_id",
+ "user_agent"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
+ },
+ {
+ "action": "integration.manager_removed",
+ "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "org",
+ "operation_type",
+ "integration",
+ "org_id",
+ "_document_id",
+ "action",
+ "actor",
+ "name",
+ "created_at",
+ "manager",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
+ },
+ {
+ "action": "integration.remove_client_secret",
+ "description": "A client secret for a GitHub App was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "integration.revoke_all_tokens",
+ "description": "All user tokens for a GitHub App were requested to be revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "application_client_id"
+ ]
+ },
+ {
+ "action": "integration.revoke_tokens",
+ "description": "Token(s) for a GitHub App were revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "application_client_id"
+ ]
+ },
+ {
+ "action": "integration.suspend",
+ "description": "A GitHub App was suspended.",
+ "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
+ },
+ {
+ "action": "integration.transfer",
+ "description": "Ownership of a GitHub App was transferred to another user or organization.",
+ "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
+ "fields": [
+ "@timestamp",
+ "user_id",
+ "name",
+ "transfer_to_id",
+ "user",
+ "requester",
+ "action",
+ "requester_id",
+ "actor_id",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "transfer_to",
+ "operation_type",
+ "request_id",
+ "actor",
+ "integration",
+ "transfer_from",
+ "transfer_from_id",
+ "transfer_from_type",
+ "transfer_to_type"
+ ],
+ "docs_reference_titles": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
+ },
+ {
+ "action": "integration.unsuspend",
+ "description": "A GitHub App was unsuspended.",
+ "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "application_client_id"
+ ],
+ "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
+ },
+ {
+ "action": "issue_dependencies.blocked_by_add",
+ "description": "An issue was marked as blocked by another issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_dependencies.blocked_by_remove",
+ "description": "The blocked by relationship between an issue and another issue was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "title",
+ "org",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "issue_dependencies.blocking_add",
+ "description": "An issue was marked as blocking another issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "issue_dependencies.blocking_remove",
+ "description": "The blocking relationship between an issue and another issue was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "marketplace_agreement_signature.create",
+ "description": "The GitHub Marketplace Developer Agreement was signed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "operation_type",
+ "created_at",
+ "action",
+ "user",
+ "user_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "marketplace_listing.approve",
+ "description": "A listing was approved for inclusion in GitHub Marketplace.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "secondary_category",
+ "actor",
+ "primary_category",
+ "user",
+ "@timestamp",
+ "_document_id",
+ "user_id",
+ "user_agent",
+ "operation_type",
+ "created_at",
+ "request_id",
+ "actor_id",
+ "marketplace_listing",
+ "integration",
+ "action"
+ ]
+ },
+ {
+ "action": "marketplace_listing.change_category",
+ "description": "A category for a listing for an app in GitHub Marketplace was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "primary_category",
+ "user_agent",
+ "request_id",
+ "actor",
+ "marketplace_listing",
+ "@timestamp",
+ "integration",
+ "org_id",
+ "action",
+ "org",
+ "secondary_category",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "marketplace_listing.create",
+ "description": "A listing for an app in GitHub Marketplace was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "primary_category",
+ "_document_id",
+ "user",
+ "created_at",
+ "user_agent",
+ "oauth_application",
+ "action",
+ "request_id",
+ "marketplace_listing",
+ "user_id",
+ "secondary_category",
+ "oauth_application_id",
+ "actor",
+ "actor_id",
+ "operation_type",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "marketplace_listing.delist",
+ "description": "A listing was removed from GitHub Marketplace.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org_id",
+ "created_at",
+ "secondary_category",
+ "operation_type",
+ "marketplace_listing",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "primary_category",
+ "integration"
+ ]
+ },
+ {
+ "action": "marketplace_listing_plan.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "created_at",
+ "actor",
+ "action",
+ "operation_type",
+ "marketplace_listing",
+ "has_free_trial",
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "yearly_price_in_cents",
+ "description",
+ "bullets",
+ "monthly_price_in_cents",
+ "marketplace_listing_plan",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "marketplace_listing_plan.publish",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "marketplace_listing_plan",
+ "marketplace_listing",
+ "description",
+ "bullets",
+ "has_free_trial",
+ "created_at",
+ "actor_id",
+ "operation_type",
+ "_document_id",
+ "action",
+ "user_agent",
+ "request_id",
+ "actor",
+ "monthly_price_in_cents",
+ "yearly_price_in_cents",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "marketplace_listing_plan.retire",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "marketplace_listing_plan",
+ "_document_id",
+ "request_id",
+ "description",
+ "yearly_price_in_cents",
+ "@timestamp",
+ "created_at",
+ "actor_id",
+ "bullets",
+ "has_free_trial",
+ "marketplace_listing",
+ "user_agent",
+ "monthly_price_in_cents",
+ "action",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "marketplace_listing_plan.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "monthly_price_in_cents",
+ "marketplace_listing",
+ "_document_id",
+ "action",
+ "description",
+ "bullets",
+ "yearly_price_in_cents",
+ "request_id",
+ "actor_id",
+ "has_free_trial",
+ "marketplace_listing_plan",
+ "user_agent",
+ "@timestamp",
+ "operation_type",
+ "actor",
+ "created_at"
+ ]
+ },
+ {
+ "action": "marketplace_listing.redraft",
+ "description": "A listing was sent back to draft state.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "secondary_category",
+ "oauth_application_id",
+ "@timestamp",
+ "action",
+ "user_agent",
+ "user_id",
+ "operation_type",
+ "oauth_application",
+ "actor",
+ "created_at",
+ "marketplace_listing",
+ "request_id",
+ "actor_id",
+ "primary_category",
+ "user"
+ ]
+ },
+ {
+ "action": "marketplace_listing.reject",
+ "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "primary_category",
+ "secondary_category",
+ "marketplace_listing",
+ "oauth_application",
+ "oauth_application_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "merge_queue.pull_request_dequeued",
+ "description": "A pull request was removed from a merge queue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "public_repo",
+ "repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "merge_queue.pull_request_queue_jump",
+ "description": "A pull request was moved ahead in a merge queue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo_id",
+ "public_repo",
+ "repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "merge_queue.queue_cleared",
+ "description": "A merge queue was cleared.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "public_repo",
+ "repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "merge_queue.update_settings",
+ "description": "The settings for a merge queue were updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "max_entries_to_build",
+ "min_entries_to_merge",
+ "repo_id",
+ "public_repo",
+ "repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "metered_billing_configuration.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "@timestamp",
+ "_document_id",
+ "user_id",
+ "action",
+ "operation_type",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "metered_billing_configuration.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "metered_billing_configuration.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "org",
+ "created_at",
+ "operation_type",
+ "org_id",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "actor",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "migration.create",
+ "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "org_id",
+ "_document_id",
+ "org",
+ "repo_id",
+ "action",
+ "actor",
+ "created_at",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "actor_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "oauth_access.create",
+ "description": "An OAuth access token was generated.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
+ "fields": [
+ "_document_id",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "@timestamp",
+ "user",
+ "user_id",
+ "created_at",
+ "action",
+ "actor_id",
+ "request_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header",
+ "oauth_application_name"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
+ },
+ {
+ "action": "oauth_access.destroy",
+ "description": "An OAuth access token was deleted.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
+ "fields": [
+ "@timestamp",
+ "user_agent",
+ "action",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "created_at",
+ "user",
+ "user_id",
+ "request_id",
+ "explanation",
+ "hashed_token",
+ "actor_id",
+ "token_scopes",
+ "oauth_application_name"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
+ },
+ {
+ "action": "oauth_access.regenerate",
+ "description": "An OAuth access token was regenerated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "user_id",
+ "_document_id",
+ "created_at",
+ "@timestamp",
+ "operation_type",
+ "action",
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "oauth_application_name"
+ ]
+ },
+ {
+ "action": "oauth_access.revoke",
+ "description": "An OAuth access token was revoked.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "request_access_security_header",
+ "hashed_token",
+ "token_id",
+ "token_scopes",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "oauth_access.update",
+ "description": "An OAuth access token was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "actor",
+ "operation_type",
+ "_document_id",
+ "user_id",
+ "created_at",
+ "action",
+ "@timestamp",
+ "user",
+ "user_agent",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "oauth_application.create",
+ "description": "An OAuth application was created.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "org",
+ "created_at",
+ "oauth_application_id",
+ "operation_type",
+ "user_agent",
+ "actor_id",
+ "org_id",
+ "action",
+ "actor",
+ "oauth_application",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.destroy",
+ "description": "An OAuth application was deleted.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "created_at",
+ "oauth_application_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "oauth_application",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "request_id",
+ "action",
+ "user",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.generate_client_secret",
+ "description": "An OAuth application's secret key was generated.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application",
+ "oauth_application_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.remove_client_secret",
+ "description": "An OAuth application's secret key was deleted.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application",
+ "oauth_application_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.reset_secret",
+ "description": "The secret key for an OAuth application was reset.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "user",
+ "user_id",
+ "action",
+ "oauth_application",
+ "operation_type",
+ "request_id",
+ "actor_id",
+ "_document_id",
+ "created_at",
+ "actor",
+ "oauth_application_id",
+ "@timestamp",
+ "user_agent"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.revoke_all_tokens",
+ "description": "All user tokens for an OAuth application were requested to be revoked.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application",
+ "oauth_application_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.revoke_tokens",
+ "description": "Token(s) for an OAuth application were revoked.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "oauth_application_id",
+ "oauth_application",
+ "actor_id",
+ "user_agent",
+ "@timestamp",
+ "request_id",
+ "user_id",
+ "action",
+ "_document_id",
+ "actor",
+ "user",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_application.transfer",
+ "description": "An OAuth application was transferred from one account to another.",
+ "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+ "fields": [
+ "actor",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "oauth_application",
+ "actor_id",
+ "oauth_application_id",
+ "@timestamp",
+ "user_id",
+ "_document_id",
+ "request_id",
+ "user",
+ "action"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+ },
+ {
+ "action": "oauth_authorization.create",
+ "description": "An authorization for an OAuth application was created.",
+ "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
+ "fields": [
+ "operation_type",
+ "user_agent",
+ "user_id",
+ "actor",
+ "org_id",
+ "_document_id",
+ "request_id",
+ "action",
+ "@timestamp",
+ "created_at",
+ "actor_id",
+ "user",
+ "business",
+ "business_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header",
+ "oauth_application_name"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
+ },
+ {
+ "action": "oauth_authorization.destroy",
+ "description": "An authorization for an OAuth application was deleted.",
+ "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
+ "fields": [
+ "user_agent",
+ "_document_id",
+ "request_id",
+ "operation_type",
+ "@timestamp",
+ "actor",
+ "created_at",
+ "explanation",
+ "user",
+ "user_id",
+ "org_id",
+ "action",
+ "actor_id",
+ "token_scopes",
+ "actor_is_bot",
+ "oauth_application_name"
+ ],
+ "docs_reference_titles": "Reviewing and revoking authorization of GitHub Apps"
+ },
+ {
+ "action": "oauth_authorization.update",
+ "description": "An authorization for an OAuth application was updated.",
+ "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
+ "fields": [
+ "org_id",
+ "request_id",
+ "user_id",
+ "actor",
+ "actor_id",
+ "user_agent",
+ "@timestamp",
+ "operation_type",
+ "action",
+ "user",
+ "created_at",
+ "_document_id",
+ "actor_is_bot",
+ "request_access_security_header",
+ "oauth_application_name"
+ ],
+ "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
+ },
+ {
+ "action": "org.add_member",
+ "description": "A user joined an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "permission",
+ "_document_id",
+ "org",
+ "operation_type",
+ "request_id",
+ "actor",
+ "user",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "org_id",
+ "user_id",
+ "actor_id",
+ "action",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "org.add_outside_collaborator",
+ "description": "An outside collaborator was added to a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "inviter",
+ "org",
+ "org_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "permission",
+ "invitee",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.advanced_security_disabled_for_new_repos",
+ "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org.advanced_security_disabled_on_all_repos",
+ "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org.advanced_security_enabled_for_new_repos",
+ "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org.advanced_security_enabled_on_all_repos",
+ "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes"
+ ]
+ },
+ {
+ "action": "org.remove_member",
+ "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "request_id",
+ "actor_id",
+ "user_agent",
+ "actor",
+ "action",
+ "user_id",
+ "@timestamp",
+ "created_at",
+ "user",
+ "operation_type",
+ "org_id",
+ "org",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "org.security_center_export_code_scanning_metrics",
+ "description": "A CSV export was requested on the CodeQL pull request alerts page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "start_date",
+ "end_date",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "org.security_center_export_coverage",
+ "description": "A CSV export was requested on the Coverage page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.security_center_export_overview_dashboard",
+ "description": "A CSV export was requested on the Overview Dashboard page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "start_date",
+ "end_date",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.security_center_export_risk",
+ "description": "A CSV export was requested on the Risk page.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "user",
+ "user_id",
+ "query",
+ "filename",
+ "requested_at",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "org.set_actions_cache_retention_policy",
+ "description": "The cache retention policy for GitHub Actions was set for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization"
+ },
+ {
+ "action": "org.set_actions_cache_storage_policy",
+ "description": "The cache storage policy for GitHub Actions was set for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization"
+ },
+ {
+ "action": "org.set_actions_fork_pr_approvals_policy",
+ "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "policy",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
+ },
+ {
+ "action": "org.set_actions_private_fork_pr_approvals_policy",
+ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "policy",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
+ },
+ {
+ "action": "org.set_actions_retention_limit",
+ "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
+ "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "limit",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
+ },
+ {
+ "action": "org.set_default_workflow_permissions",
+ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
+ },
+ {
+ "action": "org.set_fork_pr_workflows_policy",
+ "description": "The policy for workflows on private repository forks was changed.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "policy",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
+ },
+ {
+ "action": "org.set_workflow_permission_can_approve_pr",
+ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
+ "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
+ },
+ {
+ "action": "org.update_member",
+ "description": "A person's role was changed from owner to member or member to owner.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "org_id",
+ "created_at",
+ "_document_id",
+ "user",
+ "user_id",
+ "action",
+ "request_id",
+ "actor_id",
+ "old_permission",
+ "permission",
+ "actor",
+ "user_agent",
+ "operation_type",
+ "org"
+ ]
+ },
+ {
+ "action": "org.update_member_repository_creation_permission",
+ "description": "The create repository permission for organization members was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "action",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "permission",
+ "created_at",
+ "user_agent",
+ "org",
+ "org_id",
+ "_document_id",
+ "visibility",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "org.update_member_repository_invitation_permission",
+ "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
+ "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
+ "fields": [
+ "actor_id",
+ "permission",
+ "action",
+ "org_id",
+ "actor",
+ "created_at",
+ "_document_id",
+ "business_id",
+ "operation_type",
+ "org",
+ "user_agent",
+ "request_id",
+ "business",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Setting permissions for adding outside collaborators"
+ },
+ {
+ "action": "pages_protected_domain.create",
+ "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
+ "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "owner_type",
+ "domain",
+ "state",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
+ },
+ {
+ "action": "pages_protected_domain.delete",
+ "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
+ "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "owner_type",
+ "domain",
+ "state",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
+ },
+ {
+ "action": "pages_protected_domain.verify",
+ "description": "A GitHub Pages domain was verified for an organization or enterprise.",
+ "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "owner",
+ "owner_type",
+ "domain",
+ "state",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
+ },
+ {
+ "action": "passkey.register",
+ "description": "A new passkey was added.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "nickname",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "passkey.remove",
+ "description": "A new passkey was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "nickname",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "payment_method.create",
+ "description": "A new payment method was added, such as a new credit card or PayPal account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "user",
+ "operation_type",
+ "user_id",
+ "_document_id",
+ "action",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "payment_method.remove",
+ "description": "A payment method was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "created_at",
+ "actor_id",
+ "@timestamp",
+ "user_id",
+ "action",
+ "operation_type",
+ "actor",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "payment_method.update",
+ "description": "An existing payment method was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "request_id",
+ "org_id",
+ "created_at",
+ "actor_id",
+ "@timestamp",
+ "action",
+ "actor",
+ "org",
+ "user_agent",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.access_granted",
+ "description": "A fine-grained personal access token was granted access to resources.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_id",
+ "user_programmatic_access_name",
+ "repository_selection",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
+ },
+ {
+ "action": "personal_access_token.access_revoked",
+ "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_id",
+ "user_programmatic_access_name",
+ "repository_selection",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
+ },
+ {
+ "action": "personal_access_token.create",
+ "description": "Triggered when you create a fine-grained personal access token.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_name",
+ "user",
+ "user_id",
+ "repository_selection",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "personal_access_token.credential_regenerated",
+ "description": "Triggered when you regenerate a fine-grained personal access token.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_name",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.credential_revoked",
+ "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
+ "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
+ "fields": [
+ "user_programmatic_access_name",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users"
+ },
+ {
+ "action": "personal_access_token.destroy",
+ "description": "Triggered when you delete a fine-grained personal access token.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_name",
+ "user",
+ "user_id",
+ "explanation",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "personal_access_token.request_cancelled",
+ "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_name",
+ "org",
+ "org_id",
+ "repository_selection",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "user_programmatic_access_request_id"
+ ]
+ },
+ {
+ "action": "personal_access_token.request_created",
+ "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_id",
+ "user_programmatic_access_name",
+ "user",
+ "user_id",
+ "repository_selection",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "user_programmatic_access_request_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
+ },
+ {
+ "action": "personal_access_token.request_denied",
+ "description": "A request for a fine-grained personal access token to access organization resources was denied.",
+ "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user_programmatic_access_name",
+ "org",
+ "org_id",
+ "repository_selection",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "user_programmatic_access_request_id"
+ ],
+ "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
+ },
+ {
+ "action": "personal_access_token.update",
+ "description": "A fine-grained personal access token was updated.",
+ "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_programmatic_access_name",
+ "user",
+ "user_id",
+ "repository_selection",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens"
+ },
+ {
+ "action": "premium_runner.create",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "runner_group_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "premium_runner.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "premium_runner.update",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "name",
+ "runner_group_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "private_vulnerability_reporting.disable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "private_vulnerability_reporting.enable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "private_vulnerability_reporting_new_repos.disable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "private_vulnerability_reporting_new_repos.enable",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "profile_picture.update",
+ "description": "A profile picture was updated.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
+ "fields": [
+ "user",
+ "actor_id",
+ "user_id",
+ "@timestamp",
+ "created_at",
+ "owner",
+ "action",
+ "_document_id",
+ "request_id",
+ "user_agent",
+ "actor",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Personalize your profile"
+ },
+ {
+ "action": "project.access",
+ "description": "A project board visibility was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "actor",
+ "user_agent",
+ "operation_type",
+ "user",
+ "created_at",
+ "user_id",
+ "action",
+ "request_id",
+ "_document_id",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "project.close",
+ "description": "A project board was closed.",
+ "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
+ "fields": [
+ "org_id",
+ "user_agent",
+ "request_id",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "repo_id",
+ "org",
+ "_document_id",
+ "project_id",
+ "action",
+ "actor",
+ "actor_id",
+ "repo",
+ "project_kind"
+ ],
+ "docs_reference_titles": "Closing a project (classic)"
+ },
+ {
+ "action": "project_collaborator.add",
+ "description": "A collaborator was added to a project.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "collaborator_type",
+ "org",
+ "org_id",
+ "collaborator",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "public_project",
+ "project_name",
+ "project_role",
+ "old_project_role",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "project_collaborator.remove",
+ "description": "A collaborator was removed from a project.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "collaborator_type",
+ "user",
+ "user_id",
+ "collaborator",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "project_collaborator.update",
+ "description": "A project collaborator's permission level was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "public_project",
+ "project_name",
+ "collaborator_type",
+ "project_role",
+ "old_project_role",
+ "project_id",
+ "user",
+ "user_id",
+ "collaborator",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "project.create",
+ "description": "A project board was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "user",
+ "_document_id",
+ "request_id",
+ "user_id",
+ "user_agent",
+ "@timestamp",
+ "actor_id",
+ "action",
+ "created_at",
+ "actor"
+ ]
+ },
+ {
+ "action": "project.delete",
+ "description": "A project board was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "action",
+ "actor_id",
+ "operation_type",
+ "actor",
+ "user_id",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "user"
+ ]
+ },
+ {
+ "action": "project_field.create",
+ "description": "A field was created in a project board.",
+ "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
+ },
+ {
+ "action": "project_field.delete",
+ "description": "A field was deleted in a project board.",
+ "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
+ },
+ {
+ "action": "project.link",
+ "description": "A repository was linked to a project board.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo_id",
+ "action",
+ "actor_id",
+ "org_id",
+ "user_agent",
+ "request_id",
+ "actor",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "created_at",
+ "org",
+ "repo"
+ ]
+ },
+ {
+ "action": "project.open",
+ "description": "A project board was reopened.",
+ "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
+ "fields": [
+ "actor",
+ "request_id",
+ "actor_id",
+ "action",
+ "user_id",
+ "project_id",
+ "_document_id",
+ "user_agent",
+ "operation_type",
+ "user",
+ "@timestamp",
+ "created_at",
+ "project_kind",
+ "project_name"
+ ],
+ "docs_reference_titles": "Reopening a closed project (classic)"
+ },
+ {
+ "action": "project.rename",
+ "description": "A project board was renamed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "created_at",
+ "request_id",
+ "actor_id",
+ "old_name",
+ "operation_type",
+ "@timestamp",
+ "repo",
+ "_document_id",
+ "user_agent",
+ "org_id",
+ "business_id",
+ "actor",
+ "repo_id",
+ "org",
+ "business"
+ ]
+ },
+ {
+ "action": "project.unlink",
+ "description": "A repository was unlinked from a project board.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "repo_id",
+ "operation_type",
+ "actor",
+ "action",
+ "created_at",
+ "actor_id",
+ "_document_id",
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "org",
+ "org_id"
+ ]
+ },
+ {
+ "action": "project.update_org_permission",
+ "description": "The project's base-level permission for all organization members was changed or removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "org",
+ "@timestamp",
+ "_document_id",
+ "operation_type",
+ "created_at",
+ "request_id",
+ "actor_id",
+ "action",
+ "org_id",
+ "user_agent"
+ ]
+ },
+ {
+ "action": "project.update_team_permission",
+ "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "org_id",
+ "operation_type",
+ "org",
+ "actor_id",
+ "_document_id",
+ "request_id",
+ "team",
+ "@timestamp",
+ "action",
+ "user_agent",
+ "actor"
+ ]
+ },
+ {
+ "action": "project.update_user_permission",
+ "description": "A user was added to or removed from a project board or had their permission level changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "actor_id",
+ "user",
+ "user_agent",
+ "actor",
+ "created_at",
+ "org",
+ "_document_id",
+ "org_id",
+ "action",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "project_view.create",
+ "description": "A view was created in a project board.",
+ "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
+ },
+ {
+ "action": "project_view.delete",
+ "description": "A view was deleted in a project board.",
+ "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
+ },
+ {
+ "action": "project.visibility_private",
+ "description": "A project's visibility was changed from public to private.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "project_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "project_kind",
+ "project_name"
+ ]
+ },
+ {
+ "action": "project.visibility_public",
+ "description": "A project's visibility was changed from private to public.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "project_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "project_kind",
+ "project_name",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "protected_branch.update_merge_queue_enforcement_level",
+ "description": "Enforcement of the merge queue was modified for a branch.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "merge_queue_enforcement_level",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
+ },
+ {
+ "action": "public_key.create",
+ "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
+ "fields": [
+ "read_only",
+ "user_agent",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "_document_id",
+ "key",
+ "fingerprint",
+ "actor",
+ "action",
+ "user",
+ "user_id",
+ "@timestamp",
+ "request_id",
+ "title",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
+ },
+ {
+ "action": "public_key.delete",
+ "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
+ "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
+ "fields": [
+ "fingerprint",
+ "user_agent",
+ "read_only",
+ "explanation",
+ "repo",
+ "@timestamp",
+ "action",
+ "key",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "title",
+ "request_id",
+ "actor_id",
+ "repo_id",
+ "created_at",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
+ },
+ {
+ "action": "public_key.unverification_failure",
+ "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "title",
+ "key",
+ "fingerprint",
+ "read_only",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "token_scopes"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "public_key.unverify",
+ "description": "A user account's SSH key or a repository's deploy key was unverified.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "created_at",
+ "operation_type",
+ "_document_id",
+ "title",
+ "request_id",
+ "key",
+ "action",
+ "actor",
+ "read_only",
+ "explanation",
+ "repo_id",
+ "@timestamp",
+ "actor_id",
+ "repo",
+ "user_agent",
+ "fingerprint"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "public_key.update",
+ "description": "A user account's SSH key or a repository's deploy key was updated.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "actor",
+ "user_agent",
+ "key",
+ "fingerprint",
+ "read_only",
+ "repo_id",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "repo",
+ "action",
+ "_document_id",
+ "request_id",
+ "title",
+ "@timestamp",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "public_key.verification_failure",
+ "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "repo_id",
+ "actor",
+ "key",
+ "fingerprint",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "oauth_application_id",
+ "title",
+ "action",
+ "user_agent",
+ "created_at",
+ "repo",
+ "read_only",
+ "operation_type",
+ "_document_id",
+ "user",
+ "user_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "public_key.verify",
+ "description": "A user account's SSH key or a repository's deploy key was verified.",
+ "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
+ "fields": [
+ "operation_type",
+ "user",
+ "@timestamp",
+ "_document_id",
+ "action",
+ "created_at",
+ "key",
+ "fingerprint",
+ "actor_id",
+ "actor",
+ "title",
+ "user_agent",
+ "user_id",
+ "request_id",
+ "read_only",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
+ },
+ {
+ "action": "repo.access",
+ "description": "The visibility of a repository changed.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
+ "fields": [
+ "repo_id",
+ "user",
+ "request_id",
+ "operation_type",
+ "@timestamp",
+ "actor_id",
+ "user_id",
+ "created_at",
+ "user_agent",
+ "actor",
+ "action",
+ "repo",
+ "visibility",
+ "_document_id",
+ "previous_visibility",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
+ },
+ {
+ "action": "repo.actions_enabled",
+ "description": "GitHub Actions was enabled for a repository.",
+ "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
+ },
+ {
+ "action": "repo.add_member",
+ "description": "A collaborator was added to a repository.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
+ "fields": [
+ "visibility",
+ "repo",
+ "created_at",
+ "user_agent",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "repo_id",
+ "user",
+ "request_id",
+ "action",
+ "user_id",
+ "oauth_application_id",
+ "org",
+ "org_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Inviting collaborators to a personal repository"
+ },
+ {
+ "action": "repo.add_topic",
+ "description": "A topic was added to a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
+ "fields": [
+ "action",
+ "user_agent",
+ "actor",
+ "repo",
+ "repo_id",
+ "user",
+ "org",
+ "org_id",
+ "request_id",
+ "actor_id",
+ "topic",
+ "@timestamp",
+ "_document_id",
+ "user_id",
+ "created_at",
+ "operation_type",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
+ },
+ {
+ "action": "repo.advanced_security_disabled",
+ "description": "GitHub Advanced Security was disabled for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "repository",
+ "repository_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
+ },
+ {
+ "action": "repo.advanced_security_enabled",
+ "description": "GitHub Advanced Security was enabled for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "repository",
+ "repository_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
+ },
+ {
+ "action": "repo.archived",
+ "description": "A repository was archived.",
+ "docs_reference_links": "/repositories/archiving-a-github-repository",
+ "fields": [
+ "repo_id",
+ "user_agent",
+ "user_id",
+ "created_at",
+ "@timestamp",
+ "repo",
+ "user",
+ "operation_type",
+ "visibility",
+ "action",
+ "actor_id",
+ "actor",
+ "_document_id",
+ "request_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/archiving-a-github-repository"
+ },
+ {
+ "action": "repo.change_merge_setting",
+ "description": "Pull request merge options were changed for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "oauth_application_id",
+ "user_agent",
+ "request_id",
+ "created_at",
+ "@timestamp",
+ "_document_id",
+ "actor_id",
+ "operation_type",
+ "action",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repo.code_scanning_analysis_deleted",
+ "description": "Code scanning analysis for a repository was deleted.",
+ "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "tool",
+ "category",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
+ },
+ {
+ "action": "repo.code_scanning_configuration_for_branch_deleted",
+ "description": "A code scanning configuration for a branch of a repository was deleted.",
+ "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "tool",
+ "branch",
+ "category",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Resolving code scanning alerts"
+ },
+ {
+ "action": "repo.config.disable_collaborators_only",
+ "description": "The interaction limit for collaborators only was disabled.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "user_agent",
+ "actor",
+ "actor_id",
+ "repo_id",
+ "_document_id",
+ "action",
+ "created_at",
+ "repo",
+ "operation_type",
+ "@timestamp",
+ "request_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.disable_contributors_only",
+ "description": "The interaction limit for prior contributors only was disabled in a repository.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "repo",
+ "@timestamp",
+ "request_id",
+ "actor",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "repo_id",
+ "action",
+ "operation_type",
+ "created_at"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.disable_sockpuppet_disallowed",
+ "description": "The interaction limit for existing users only was disabled in a repository.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "actor",
+ "request_id",
+ "repo_id",
+ "action",
+ "user_agent",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "actor_id",
+ "repo",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.enable_collaborators_only",
+ "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "actor",
+ "oauth_application_id",
+ "created_at",
+ "action",
+ "request_id",
+ "repo_id",
+ "repo",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.enable_contributors_only",
+ "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "operation_type",
+ "created_at",
+ "actor",
+ "org",
+ "action",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "org_id",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.config.enable_sockpuppet_disallowed",
+ "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
+ "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+ "fields": [
+ "actor",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "request_id",
+ "action",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+ },
+ {
+ "action": "repo.configure_self_hosted_jit_runner",
+ "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
+ "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "token_id",
+ "token_scopes",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
+ },
+ {
+ "action": "repo.create",
+ "description": "A repository was created.",
+ "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
+ "fields": [
+ "repo",
+ "user_id",
+ "visibility",
+ "repo_id",
+ "user",
+ "request_id",
+ "actor_id",
+ "action",
+ "operation_type",
+ "request_category",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "actor",
+ "user_agent",
+ "org",
+ "oauth_application_id",
+ "org_id",
+ "request_method",
+ "business",
+ "business_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
+ },
+ {
+ "action": "repo.create_actions_secret",
+ "description": "A GitHub Actions secret was created for a repository.",
+ "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Using secrets in GitHub Actions"
+ },
+ {
+ "action": "repo.create_actions_variable",
+ "description": "A GitHub Actions variable was created for a repository.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "repo.create_integration_secret",
+ "description": "A Codespaces or Dependabot secret was created for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "visibility",
+ "integration",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.destroy",
+ "description": "A repository was deleted.",
+ "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
+ "fields": [
+ "repo",
+ "_document_id",
+ "user_agent",
+ "user_id",
+ "actor",
+ "action",
+ "user",
+ "repo_id",
+ "operation_type",
+ "request_category",
+ "actor_id",
+ "visibility",
+ "request_id",
+ "created_at",
+ "@timestamp",
+ "request_method",
+ "oauth_application_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
+ },
+ {
+ "action": "repo.pages_cname",
+ "description": "A GitHub Pages custom domain was modified in a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "@timestamp",
+ "visibility",
+ "repo",
+ "repo_id",
+ "user",
+ "request_id",
+ "actor_id",
+ "cname",
+ "user_agent",
+ "user_id",
+ "created_at",
+ "_document_id",
+ "action",
+ "operation_type",
+ "old_cname",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.pages_create",
+ "description": "A GitHub Pages site was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user",
+ "_document_id",
+ "user_id",
+ "visibility",
+ "action",
+ "user_agent",
+ "operation_type",
+ "repo_id",
+ "created_at",
+ "@timestamp",
+ "request_id",
+ "actor",
+ "repo",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.pages_destroy",
+ "description": "A GitHub Pages site was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "user_id",
+ "action",
+ "request_id",
+ "user",
+ "repo",
+ "user_agent",
+ "_document_id",
+ "actor_id",
+ "@timestamp",
+ "actor",
+ "visibility",
+ "operation_type",
+ "repo_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.pages_https_redirect_disabled",
+ "description": "HTTPS redirects were disabled for a GitHub Pages site.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "actor_id",
+ "repo_id",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "visibility",
+ "user_id",
+ "request_id",
+ "repo",
+ "@timestamp",
+ "operation_type",
+ "action",
+ "created_at",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_https_redirect_enabled",
+ "description": "HTTPS redirects were enabled for a GitHub Pages site.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "user_id",
+ "created_at",
+ "visibility",
+ "actor",
+ "actor_id",
+ "user",
+ "operation_type",
+ "repo_id",
+ "action",
+ "repo",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_private",
+ "description": "A GitHub Pages site visibility was changed to private.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "repo.pages_public",
+ "description": "A GitHub Pages site visibility was changed to public.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_soft_delete",
+ "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_soft_delete_restore",
+ "description": "A GitHub Pages site that was previously soft-deleted was restored.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.pages_source",
+ "description": "A GitHub Pages source was modified.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "actor_id",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "@timestamp",
+ "repo_id",
+ "user",
+ "_document_id",
+ "request_id",
+ "visibility",
+ "repo",
+ "created_at",
+ "action",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.register_self_hosted_runner",
+ "description": "A new self-hosted runner was registered.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
+ "fields": [
+ "actor_id",
+ "repo",
+ "operation_type",
+ "action",
+ "@timestamp",
+ "actor",
+ "user_agent",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "repo_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Adding self-hosted runners"
+ },
+ {
+ "action": "repo.remove_actions_secret",
+ "description": "A GitHub Actions secret was deleted for a repository.",
+ "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Using secrets in GitHub Actions"
+ },
+ {
+ "action": "repo.remove_actions_variable",
+ "description": "A GitHub Actions variable was deleted for a repository.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "repo.remove_integration_secret",
+ "description": "A Codespaces or Dependabot secret was deleted for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "integration",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.remove_member",
+ "description": "A collaborator was removed from a repository.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
+ "fields": [
+ "request_id",
+ "user",
+ "business",
+ "action",
+ "actor_id",
+ "org",
+ "org_id",
+ "actor",
+ "created_at",
+ "repo_id",
+ "user_agent",
+ "business_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "visibility",
+ "repo",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Removing a collaborator from a personal repository"
+ },
+ {
+ "action": "repo.remove_self_hosted_runner",
+ "description": "A self-hosted runner was removed.",
+ "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
+ "fields": [
+ "request_id",
+ "actor_id",
+ "repo_id",
+ "@timestamp",
+ "_document_id",
+ "repo",
+ "org_id",
+ "action",
+ "operation_type",
+ "user_agent",
+ "actor",
+ "created_at",
+ "org",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Removing self-hosted runners"
+ },
+ {
+ "action": "repo.remove_topic",
+ "description": "A topic was removed from a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "action",
+ "repo_id",
+ "user_agent",
+ "topic",
+ "operation_type",
+ "user_id",
+ "org",
+ "org_id",
+ "actor",
+ "business",
+ "request_id",
+ "repo",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "actor_id",
+ "business_id",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repo.rename",
+ "description": "A repository was renamed.",
+ "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
+ "fields": [
+ "user_agent",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "actor",
+ "old_name",
+ "repo",
+ "user_id",
+ "created_at",
+ "user",
+ "action",
+ "operation_type",
+ "visibility",
+ "repo_id",
+ "_document_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
+ },
+ {
+ "action": "repo.restore",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "action",
+ "_document_id",
+ "actor_id",
+ "user",
+ "operation_type",
+ "user_agent",
+ "request_id",
+ "repo_id",
+ "@timestamp",
+ "created_at",
+ "actor",
+ "user_id"
+ ]
+ },
+ {
+ "action": "repo.set_actions_cache_retention_policy",
+ "description": "The cache retention policy for GitHub Actions was set for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
+ },
+ {
+ "action": "repo.set_actions_cache_storage_policy",
+ "description": "The cache storage policy for GitHub Actions was set for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
+ },
+ {
+ "action": "repo.set_actions_fork_pr_approvals_policy",
+ "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "policy",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "public_repo"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
+ },
+ {
+ "action": "repo.set_actions_private_fork_pr_approvals_policy",
+ "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "visibility",
+ "policy",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
+ },
+ {
+ "action": "repo.set_actions_retention_limit",
+ "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "limit",
+ "repo",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
+ },
+ {
+ "action": "repo.set_default_workflow_permissions",
+ "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
+ },
+ {
+ "action": "repo.set_fork_pr_workflows_policy",
+ "description": "Triggered when the policy for workflows on private repository forks is changed.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "policy",
+ "repo",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
+ },
+ {
+ "action": "repo.set_workflow_permission_can_approve_pr",
+ "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
+ },
+ {
+ "action": "repo.staff_unlock",
+ "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "created_at",
+ "actor",
+ "repo_id",
+ "action",
+ "org",
+ "org_id",
+ "request_id",
+ "repo",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "repo.temporary_access_granted",
+ "description": "Temporary access was enabled for a repository.",
+ "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ],
+ "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
+ },
+ {
+ "action": "repo.transfer",
+ "description": "A user accepted a request to receive a transferred repository.",
+ "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
+ "fields": [
+ "@timestamp",
+ "user_id",
+ "_document_id",
+ "request_id",
+ "actor_id",
+ "repo_id",
+ "owner",
+ "user",
+ "old_user",
+ "action",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "repo",
+ "visibility",
+ "repo_was",
+ "actor"
+ ],
+ "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
+ },
+ {
+ "action": "repo.transfer_outgoing",
+ "description": "A repository was transferred to another repository network.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "new_nwo",
+ "visibility",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "public_repo",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.transfer_start",
+ "description": "A user sent a request to transfer a repository to another user or organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "_document_id",
+ "operation_type",
+ "user_id",
+ "request_id",
+ "user",
+ "action",
+ "user_agent",
+ "created_at",
+ "actor",
+ "visibility",
+ "repo_id",
+ "actor_id",
+ "repo",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.unarchived",
+ "description": "A repository was unarchived.",
+ "docs_reference_links": "/repositories/archiving-a-github-repository",
+ "fields": [
+ "actor",
+ "request_id",
+ "actor_id",
+ "repo",
+ "operation_type",
+ "created_at",
+ "_document_id",
+ "repo_id",
+ "user",
+ "@timestamp",
+ "visibility",
+ "user_agent",
+ "user_id",
+ "action",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "/repositories/archiving-a-github-repository"
+ },
+ {
+ "action": "repo.update_actions_access_settings",
+ "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "policy",
+ "old_policy",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id"
+ ]
+ },
+ {
+ "action": "repo.update_actions_secret",
+ "description": "A GitHub Actions secret was updated for a repository.",
+ "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "oauth_application_id",
+ "key",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "business",
+ "business_id",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Using secrets in GitHub Actions"
+ },
+ {
+ "action": "repo.update_actions_settings",
+ "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "new_policy",
+ "old_policy",
+ "updated_access_policy",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repo.update_actions_variable",
+ "description": "A GitHub Actions variable was updated for a repository.",
+ "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Store information in variables"
+ },
+ {
+ "action": "repo.update_default_branch",
+ "description": "The default branch for a repository was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "visibility",
+ "repo",
+ "repo_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repo.update_integration_secret",
+ "description": "A Codespaces or Dependabot secret was updated for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "key",
+ "visibility",
+ "integration",
+ "repo",
+ "repo_id",
+ "org",
+ "org_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repo.update_member",
+ "description": "A user's permission to a repository was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "action",
+ "_document_id",
+ "actor",
+ "repo_id",
+ "created_at",
+ "oauth_application_id",
+ "user",
+ "@timestamp",
+ "repo",
+ "operation_type",
+ "request_id",
+ "org_id",
+ "actor_id",
+ "visibility",
+ "old_permission",
+ "org",
+ "user_id",
+ "old_base_role",
+ "old_repo_permission",
+ "old_repo_base_role",
+ "new_repo_base_role",
+ "new_repo_permission",
+ "token_scopes",
+ "programmatic_access_type",
+ "actor_is_bot"
+ ]
+ },
+ {
+ "action": "repository_image.create",
+ "description": "An image to represent a repository was uploaded.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "repo_id",
+ "action",
+ "request_id",
+ "actor",
+ "content_type",
+ "repo",
+ "@timestamp",
+ "_document_id",
+ "user",
+ "user_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_image.destroy",
+ "description": "An image to represent a repository was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "content_type",
+ "created_at",
+ "actor_id",
+ "user_id",
+ "operation_type",
+ "request_id",
+ "_document_id",
+ "actor",
+ "repo_id",
+ "user_agent",
+ "repo",
+ "user",
+ "action",
+ "@timestamp",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_invitation.accept",
+ "description": "An invitation to join a repository was accepted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "created_at",
+ "request_id",
+ "repo",
+ "invitee",
+ "operation_type",
+ "actor",
+ "repo_id",
+ "_document_id",
+ "action",
+ "user_agent",
+ "inviter",
+ "@timestamp",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repository_invitation.cancel",
+ "description": "An invitation to join a repository was canceled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "inviter",
+ "action",
+ "operation_type",
+ "_document_id",
+ "repo_id",
+ "repo",
+ "@timestamp",
+ "user_agent",
+ "invitee",
+ "created_at",
+ "request_id",
+ "actor",
+ "actor_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "repository_invitation.create",
+ "description": "An invitation to join a repository was sent.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "invitee",
+ "action",
+ "request_id",
+ "inviter",
+ "repo",
+ "created_at",
+ "user_agent",
+ "repo_id",
+ "operation_type",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "repository_invitation.reject",
+ "description": "An invitation to join a repository was declined.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "repo",
+ "_document_id",
+ "actor",
+ "invitee",
+ "action",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "inviter",
+ "user_agent",
+ "repo_id"
+ ]
+ },
+ {
+ "action": "repository_ruleset.create",
+ "description": "A repository ruleset was created.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "ruleset_id",
+ "ruleset_name",
+ "ruleset_enforcement",
+ "ruleset_source_type",
+ "ruleset_rules",
+ "ruleset_conditions",
+ "ruleset_bypass_actors",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
+ },
+ {
+ "action": "repository_ruleset.destroy",
+ "description": "A repository ruleset was deleted.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "ruleset_id",
+ "ruleset_name",
+ "ruleset_enforcement",
+ "ruleset_source_type",
+ "ruleset_rules",
+ "ruleset_bypass_actors",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
+ },
+ {
+ "action": "repository_ruleset.update",
+ "description": "A repository ruleset was edited.",
+ "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "old_name",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "ruleset_id",
+ "ruleset_name",
+ "ruleset_enforcement",
+ "ruleset_source_type",
+ "ruleset_rules_updated",
+ "ruleset_conditions_added",
+ "ruleset_conditions_deleted",
+ "ruleset_old_enforcement",
+ "ruleset_rules_added",
+ "ruleset_rules_deleted",
+ "ruleset_old_name",
+ "ruleset_conditions_updated",
+ "ruleset_bypass_actors_added",
+ "ruleset_bypass_actors_deleted",
+ "ruleset_bypass_actors_updated",
+ "actor_is_bot"
+ ],
+ "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
+ },
+ {
+ "action": "security_key.register",
+ "description": "A security key was registered for an account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user",
+ "created_at",
+ "user_id",
+ "action",
+ "operation_type",
+ "request_id",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "user_agent",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "security_key.remove",
+ "description": "A security key was removed from an account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "user_id",
+ "operation_type",
+ "_document_id",
+ "user_agent",
+ "@timestamp",
+ "request_id",
+ "actor_id",
+ "action",
+ "created_at",
+ "user",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "social_identity.linked",
+ "description": "A user linked a social identity to their account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user_id",
+ "action",
+ "actor_id",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "social_identity.unlinked",
+ "description": "A user unlinked a social identity from their account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "social_identity.unlinked_all",
+ "description": "A user unlinked all social identities from their account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "request_access_security_header",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.agreement_sign",
+ "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.custom_amount_settings_change",
+ "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "sponsors_listing_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
+ },
+ {
+ "action": "sponsors.fiscal_host_change",
+ "description": "The fiscal host for a GitHub Sponsors listing was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "org",
+ "org_id",
+ "sponsors_listing_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.repo_funding_links_file_action",
+ "description": "The FUNDING file in a repository was changed.",
+ "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
+ "fields": [
+ "@timestamp",
+ "action",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "repository",
+ "repository_id",
+ "actor",
+ "user_agent",
+ "actor_id",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_cancel",
+ "description": "A sponsorship was canceled.",
+ "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
+ "fields": [
+ "operation_type",
+ "_document_id",
+ "created_at",
+ "actor",
+ "user",
+ "action",
+ "actor_id",
+ "user_id",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "Downgrading a sponsorship"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_create",
+ "description": "A sponsorship was created, by sponsoring an account.",
+ "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
+ "fields": [
+ "actor",
+ "user_id",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "user",
+ "operation_type",
+ "created_at",
+ "actor_id",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_payment_complete",
+ "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
+ "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
+ "fields": [
+ "active",
+ "user",
+ "user_id",
+ "actor",
+ "actor_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_preference_change",
+ "description": "The option to receive email updates from a sponsored account was changed.",
+ "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
+ "fields": [
+ "actor_id",
+ "action",
+ "@timestamp",
+ "request_id",
+ "user_id",
+ "created_at",
+ "user",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
+ },
+ {
+ "action": "sponsors.sponsor_sponsorship_tier_change",
+ "description": "A sponsorship was upgraded or downgraded.",
+ "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
+ "fields": [
+ "user_id",
+ "actor",
+ "actor_id",
+ "action",
+ "user",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "created_at"
+ ],
+ "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
+ },
+ {
+ "action": "sponsors.sponsored_developer_approve",
+ "description": "A GitHub Sponsors account was approved.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
+ "fields": [
+ "user_id",
+ "action",
+ "user_agent",
+ "request_id",
+ "actor",
+ "user",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "actor_id",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+ },
+ {
+ "action": "sponsors.sponsored_developer_create",
+ "description": "A GitHub Sponsors account was created.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
+ "fields": [
+ "user_id",
+ "operation_type",
+ "request_id",
+ "actor_id",
+ "@timestamp",
+ "_document_id",
+ "user",
+ "action",
+ "created_at",
+ "user_agent",
+ "actor"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+ },
+ {
+ "action": "sponsors.sponsored_developer_disable",
+ "description": "A GitHub Sponsors account was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "sponsors.sponsored_developer_profile_update",
+ "description": "The profile for GitHub Sponsors account was edited.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
+ "fields": [
+ "@timestamp",
+ "actor_id",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "request_id",
+ "actor",
+ "action",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
+ },
+ {
+ "action": "sponsors.sponsored_developer_redraft",
+ "description": "A GitHub Sponsors account was returned to draft state from approved state.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "created_at",
+ "request_id",
+ "user",
+ "action",
+ "user_agent",
+ "operation_type",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "user_id"
+ ]
+ },
+ {
+ "action": "sponsors.sponsored_developer_request_approval",
+ "description": "An application for GitHub Sponsors was submitted for approval.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
+ "fields": [
+ "user_agent",
+ "user",
+ "@timestamp",
+ "actor_id",
+ "user_id",
+ "request_id",
+ "_document_id",
+ "actor",
+ "action",
+ "operation_type",
+ "created_at"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+ },
+ {
+ "action": "sponsors.sponsored_developer_tier_description_update",
+ "description": "The description for a sponsorship tier was changed.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
+ "fields": [
+ "operation_type",
+ "request_id",
+ "actor",
+ "user_id",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "actor_id",
+ "user",
+ "created_at"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
+ },
+ {
+ "action": "sponsors.sponsored_developer_update_newsletter_send",
+ "description": "Triggered when you send an email update to your sponsors.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
+ "fields": [
+ "request_id",
+ "actor",
+ "action",
+ "user_agent",
+ "operation_type",
+ "_document_id",
+ "created_at",
+ "actor_id",
+ "user",
+ "user_id",
+ "@timestamp"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
+ },
+ {
+ "action": "sponsors.sponsors_patreon_user_create",
+ "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "patreon_email",
+ "patreon_username",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account"
+ },
+ {
+ "action": "sponsors.sponsors_patreon_user_destroy",
+ "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
+ "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "patreon_email",
+ "patreon_username",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ],
+ "docs_reference_titles": "Unlinking your Patreon account from GitHub"
+ },
+ {
+ "action": "sponsors.update_tier_repository",
+ "description": "A GitHub Sponsors tier changed access for a repository.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "repo",
+ "repo_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.update_tier_welcome_message",
+ "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sponsors.waitlist_join",
+ "description": "You join the waitlist to join GitHub Sponsors.",
+ "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
+ "fields": [
+ "request_id",
+ "actor",
+ "user_id",
+ "user_agent",
+ "actor_id",
+ "action",
+ "operation_type",
+ "created_at",
+ "user",
+ "@timestamp",
+ "_document_id"
+ ],
+ "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+ },
+ {
+ "action": "sponsors.withdraw_agreement_signature",
+ "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "sponsors_listing_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "sub_issues.parent_issue_add",
+ "description": "A parent issue was added to an issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "sub_issues.parent_issue_remove",
+ "description": "A parent issue was removed from an issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "sub_issues.sub_issue_add",
+ "description": "A sub-issue was added to an issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "sub_issues.sub_issue_remove",
+ "description": "A sub-issue was removed from an issue.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "title",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "successor_invitation.accept",
+ "description": "Triggered when you accept a succession invitation.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+ },
+ {
+ "action": "successor_invitation.cancel",
+ "description": "Triggered when you cancel a succession invitation.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+ },
+ {
+ "action": "successor_invitation.create",
+ "description": "Triggered when you create a succession invitation.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+ },
+ {
+ "action": "successor_invitation.decline",
+ "description": "Triggered when you decline a succession invitation.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+ },
+ {
+ "action": "successor_invitation.destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "successor_invitation.revoke",
+ "description": "Triggered when you revoke a succession invitation.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+ },
+ {
+ "action": "trusted_device.register",
+ "description": "A new trusted device was added.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "trusted_device.remove",
+ "description": "A trusted device was removed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.abort",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "action",
+ "request_id",
+ "user_id",
+ "@timestamp",
+ "_document_id",
+ "user",
+ "user_agent",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.complete",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "@timestamp",
+ "created_at",
+ "user_id",
+ "operation_type",
+ "user",
+ "_document_id",
+ "user_agent",
+ "action"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.ignore",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "_document_id",
+ "created_at",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "user",
+ "action"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.staff_approve",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "request_id",
+ "user",
+ "user_id",
+ "user_agent",
+ "operation_type",
+ "action",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.staff_decline",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "actor",
+ "action",
+ "@timestamp",
+ "user_agent",
+ "operation_type",
+ "user",
+ "created_at",
+ "request_id",
+ "actor_id",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.start",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "operation_type",
+ "@timestamp",
+ "user_agent",
+ "request_id",
+ "created_at",
+ "user_id",
+ "action",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "two_factor_account_recovery.two_factor_destroy",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "user_id",
+ "action",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "user",
+ "_document_id",
+ "request_id"
+ ]
+ },
+ {
+ "action": "two_factor_authentication.add_factor",
+ "description": "A secondary authentication factor was added to a user account.",
+ "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
+ },
+ {
+ "action": "two_factor_authentication.disabled",
+ "description": "Two-factor authentication was disabled for a user account.",
+ "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
+ "fields": [
+ "actor",
+ "action",
+ "_document_id",
+ "user_agent",
+ "user",
+ "user_id",
+ "actor_id",
+ "created_at",
+ "operation_type",
+ "request_id",
+ "@timestamp",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Disabling two-factor authentication for your personal account"
+ },
+ {
+ "action": "two_factor_authentication.enabled",
+ "description": "Two-factor authentication was enabled for a user account.",
+ "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
+ "fields": [
+ "actor",
+ "operation_type",
+ "user_agent",
+ "action",
+ "created_at",
+ "actor_id",
+ "@timestamp",
+ "request_id",
+ "user",
+ "user_id",
+ "_document_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Configuring two-factor authentication"
+ },
+ {
+ "action": "two_factor_authentication.password_reset_fallback_sms",
+ "description": "A one-time password code was sent to a user account fallback phone number.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "created_at",
+ "user",
+ "user_id",
+ "action",
+ "@timestamp",
+ "request_id",
+ "_document_id",
+ "user_agent"
+ ]
+ },
+ {
+ "action": "two_factor_authentication.recovery_codes_regenerated",
+ "description": "Two factor recovery codes were regenerated for a user account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor",
+ "operation_type",
+ "_document_id",
+ "user_id",
+ "action",
+ "user",
+ "user_agent",
+ "actor_id",
+ "@timestamp",
+ "created_at"
+ ]
+ },
+ {
+ "action": "two_factor_authentication.remove_factor",
+ "description": "A secondary authentication factor was removed from a user account.",
+ "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
+ },
+ {
+ "action": "two_factor_authentication.sign_in_fallback_sms",
+ "description": "A one-time password code was sent to a user account fallback phone number.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "operation_type",
+ "user_id",
+ "user",
+ "user_agent",
+ "created_at",
+ "_document_id",
+ "action",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "two_factor_authentication.update_fallback",
+ "description": "The two-factor authentication fallback for a user account was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "user",
+ "user_id",
+ "operation_type",
+ "user_agent",
+ "action",
+ "request_id",
+ "actor",
+ "actor_id"
+ ]
+ },
+ {
+ "action": "user.add_email",
+ "description": "An email address was added to a user account.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
+ "fields": [
+ "action",
+ "request_id",
+ "user",
+ "user_id",
+ "user_agent",
+ "operation_type",
+ "_document_id",
+ "actor_id",
+ "actor",
+ "email",
+ "@timestamp",
+ "created_at",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Adding an email address to your GitHub account"
+ },
+ {
+ "action": "user.async_delete",
+ "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "user_id",
+ "created_at",
+ "user",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "actor_id",
+ "operation_type",
+ "user_agent",
+ "action",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.audit_log_export",
+ "description": "Audit log entries were exported.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user",
+ "action",
+ "request_id",
+ "actor",
+ "@timestamp",
+ "_document_id",
+ "user_agent",
+ "user_id",
+ "operation_type",
+ "created_at"
+ ]
+ },
+ {
+ "action": "user.block_user",
+ "description": "A user was blocked by another user.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "action",
+ "actor",
+ "user_id",
+ "_document_id",
+ "actor_id",
+ "@timestamp",
+ "user_agent",
+ "user",
+ "request_id",
+ "blocked_user",
+ "operation_type",
+ "created_at",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.change_password",
+ "description": "A user changed their password.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "actor_id",
+ "operation_type",
+ "actor",
+ "user",
+ "user_id",
+ "action",
+ "created_at",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.codespaces_trusted_repo_access_granted",
+ "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
+ "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Managing access to other repositories within your codespace"
+ },
+ {
+ "action": "user.codespaces_trusted_repo_access_revoked",
+ "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
+ "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ],
+ "docs_reference_titles": "Managing access to other repositories within your codespace"
+ },
+ {
+ "action": "user.create",
+ "description": "A new user account was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "email",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "request_id",
+ "user",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "actor_id",
+ "action",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "user.create_integration_secret",
+ "description": "A user secret for Codespaces was created.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.creation_rate_limit_exceeded",
+ "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "created_at",
+ "user_agent",
+ "_document_id",
+ "operation_type",
+ "oauth_application_id",
+ "action",
+ "actor",
+ "actor_id",
+ "request_id",
+ "user_id",
+ "@timestamp",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "user.delete",
+ "description": "A user account was destroyed by an asynchronous job.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "action",
+ "request_id",
+ "user_id",
+ "actor",
+ "actor_id",
+ "user",
+ "@timestamp",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.demote",
+ "description": "A site administrator was demoted to an ordinary user account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "oauth_application_id",
+ "action",
+ "user",
+ "created_at",
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "operation_type",
+ "_document_id",
+ "user_id",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.destroy",
+ "description": "A user deleted his or her account, triggering user.async_delete.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor",
+ "user",
+ "_document_id",
+ "created_at",
+ "user_agent",
+ "user_id",
+ "operation_type",
+ "actor_id",
+ "action",
+ "@timestamp",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.device_verification_failure",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "actor",
+ "created_at",
+ "_document_id",
+ "@timestamp",
+ "user",
+ "user_agent",
+ "user_id",
+ "actor_id",
+ "action",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.device_verification_requested",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "user_id",
+ "actor",
+ "operation_type",
+ "created_at",
+ "_document_id",
+ "@timestamp",
+ "user",
+ "actor_id",
+ "action",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.device_verification_success",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "user",
+ "_document_id",
+ "action",
+ "operation_type",
+ "user_agent",
+ "created_at",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.disable_collaborators_only",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "user.disable_contributors_only",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "user.disable_sockpuppet_disallowed",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "user_email.confirm_claim",
+ "description": "An enterprise managed user claimed an email address.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user_email.mark_as_unclaimed",
+ "description": "N/A",
+ "docs_reference_links": "An enterprise managed user unclaimed an email address.",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "business",
+ "business_id",
+ "actor_is_bot",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
+ },
+ {
+ "action": "user.enable_collaborators_only",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "user.enable_contributors_only",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "user.enable_sockpuppet_disallowed",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id"
+ ]
+ },
+ {
+ "action": "user.failed_login",
+ "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "action",
+ "operation_type",
+ "request_id",
+ "created_at",
+ "_document_id",
+ "@timestamp",
+ "user",
+ "org_id",
+ "actor",
+ "actor_id",
+ "user_agent"
+ ]
+ },
+ {
+ "action": "user.forgot_password",
+ "description": "A user requested a password reset.",
+ "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
+ "fields": [
+ "action",
+ "_document_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "operation_type",
+ "@timestamp",
+ "email",
+ "created_at",
+ "user_id",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
+ },
+ {
+ "action": "user.grant_github_developer",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "created_at",
+ "user_agent",
+ "@timestamp",
+ "_document_id",
+ "user",
+ "user_id",
+ "actor",
+ "operation_type",
+ "request_id"
+ ]
+ },
+ {
+ "action": "user.hide_private_contributions_count",
+ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Manage visibility settings for private contributions"
+ },
+ {
+ "action": "user.login",
+ "description": "A user signed in.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "user_id",
+ "actor_id",
+ "@timestamp",
+ "user",
+ "action",
+ "operation_type",
+ "_document_id",
+ "request_id",
+ "created_at",
+ "actor",
+ "passkey_nickname",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.logout",
+ "description": "A user signed out.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.new_device_used",
+ "description": "A user signed in from a new device.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "user_id",
+ "actor",
+ "operation_type",
+ "created_at",
+ "user_agent",
+ "actor_id",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.promote",
+ "description": "An ordinary user account was promoted to a site administrator.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "action",
+ "actor",
+ "actor_id",
+ "user",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "oauth_application_id",
+ "request_id",
+ "operation_type",
+ "_document_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.recreate",
+ "description": "A user's account was restored.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "user",
+ "action",
+ "actor_id",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "user_id",
+ "created_at",
+ "actor",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "user.remove_email",
+ "description": "An email address was removed from a user account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "user",
+ "user_id",
+ "operation_type",
+ "actor",
+ "actor_id",
+ "created_at",
+ "email",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "user.remove_integration_secret",
+ "description": "A user secret for Codespaces was deleted.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.rename",
+ "description": "A username was changed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "action",
+ "request_id",
+ "actor_id",
+ "old_login",
+ "created_at",
+ "_document_id",
+ "actor",
+ "user_id",
+ "@timestamp",
+ "operation_type",
+ "user_agent",
+ "token_scopes",
+ "programmatic_access_type"
+ ]
+ },
+ {
+ "action": "user.reset_password",
+ "description": "A user reset their account password.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "user_agent",
+ "user",
+ "request_id",
+ "user_id",
+ "created_at",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user_session.country_change",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "created_at",
+ "request_id",
+ "user_id",
+ "action",
+ "@timestamp",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "user",
+ "user_agent",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "user.show_private_contributions_count",
+ "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
+ "fields": [
+ "@timestamp",
+ "_document_id",
+ "request_id",
+ "user_id",
+ "action",
+ "actor",
+ "user",
+ "operation_type",
+ "user_agent",
+ "actor_id",
+ "created_at",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Manage visibility settings for private contributions"
+ },
+ {
+ "action": "user.sign_in_from_unrecognized_device",
+ "description": "A user signed in from an unrecognized device.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "action",
+ "_document_id",
+ "user_agent",
+ "user",
+ "user_id",
+ "operation_type",
+ "created_at",
+ "actor",
+ "actor_id",
+ "@timestamp",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.sign_in_from_unrecognized_device_and_location",
+ "description": "A user signed in from an unrecognized device and location.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user",
+ "user_id",
+ "@timestamp",
+ "user_agent",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "action",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user_status.destroy",
+ "description": "Triggered when you clear the status on your profile.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "org",
+ "user_id",
+ "actor",
+ "message",
+ "user",
+ "actor_id",
+ "created_at",
+ "request_id",
+ "limited_availability",
+ "action",
+ "emoji",
+ "operation_type",
+ "user_agent",
+ "@timestamp",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user_status.update",
+ "description": "Triggered when you set or change the status on your profile.",
+ "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
+ "fields": [
+ "limited_availability",
+ "user",
+ "action",
+ "actor_id",
+ "message",
+ "user_id",
+ "created_at",
+ "_document_id",
+ "request_id",
+ "@timestamp",
+ "user_agent",
+ "emoji",
+ "org",
+ "actor",
+ "operation_type",
+ "token_scopes",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Personalize your profile"
+ },
+ {
+ "action": "user.suspend",
+ "description": "A user account was suspended.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "oauth_application_id",
+ "operation_type",
+ "actor_id",
+ "user",
+ "user_agent",
+ "request_id",
+ "actor",
+ "created_at",
+ "_document_id",
+ "@timestamp",
+ "user_id",
+ "action",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.toggle_warn_private_email",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "user",
+ "actor_id",
+ "@timestamp",
+ "operation_type",
+ "_document_id",
+ "user_agent",
+ "actor",
+ "action",
+ "user_id",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.two_factor_challenge_failure",
+ "description": "A 2FA challenge issued for a user account failed.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "operation_type",
+ "created_at",
+ "_document_id",
+ "user_agent",
+ "user",
+ "actor_id",
+ "actor",
+ "user_id",
+ "@timestamp",
+ "action",
+ "request_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.two_factor_challenge_success",
+ "description": "A 2FA challenge issued for a user account succeeded.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "@timestamp",
+ "_document_id",
+ "user_id",
+ "operation_type",
+ "actor_id",
+ "user",
+ "actor",
+ "user_agent",
+ "request_id",
+ "action",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.two_factor_recover",
+ "description": "A user used their 2FA recovery codes.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "operation_type",
+ "user_agent",
+ "request_id",
+ "user",
+ "action",
+ "actor",
+ "actor_id",
+ "created_at",
+ "@timestamp",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.two_factor_recovery_codes_downloaded",
+ "description": "A user downloaded 2FA recovery codes for their account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_id",
+ "operation_type",
+ "actor_id",
+ "user",
+ "request_id",
+ "action",
+ "@timestamp",
+ "created_at",
+ "user_agent",
+ "actor",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.two_factor_recovery_codes_printed",
+ "description": "A user printed 2FA recovery codes for their account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user",
+ "action",
+ "operation_type",
+ "user_agent",
+ "request_id",
+ "user_id",
+ "created_at",
+ "_document_id",
+ "actor",
+ "actor_id",
+ "@timestamp"
+ ]
+ },
+ {
+ "action": "user.two_factor_recovery_codes_viewed",
+ "description": "A user viewed 2FA recovery codes for their account.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "user_agent",
+ "actor",
+ "user_id",
+ "action",
+ "created_at",
+ "user",
+ "operation_type",
+ "@timestamp",
+ "request_id",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.two_factor_requested",
+ "description": "A user was prompted for a two-factor authentication code.",
+ "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
+ "fields": [
+ "user",
+ "actor_id",
+ "action",
+ "user_agent",
+ "request_id",
+ "created_at",
+ "_document_id",
+ "user_id",
+ "operation_type",
+ "@timestamp",
+ "actor"
+ ],
+ "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
+ },
+ {
+ "action": "user.unblock_user",
+ "description": "A user was unblocked by another user.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor_id",
+ "action",
+ "request_id",
+ "_document_id",
+ "blocked_user",
+ "operation_type",
+ "actor",
+ "@timestamp",
+ "user_agent",
+ "user_id",
+ "user",
+ "created_at",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.unsuspend",
+ "description": "A user account was unsuspended.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "request_id",
+ "_document_id",
+ "user",
+ "action",
+ "user_agent",
+ "actor",
+ "oauth_application_id",
+ "operation_type",
+ "actor_id",
+ "created_at",
+ "@timestamp",
+ "user_id",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.update_integration_secret",
+ "description": "A user secret for Codespaces was updated.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "key",
+ "visibility",
+ "integration",
+ "user",
+ "user_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "user.update_new_repository_default_branch_setting",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "created_at",
+ "user",
+ "user_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "_document_id",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "workflows.approve_workflow_job",
+ "description": "A workflow job was approved.",
+ "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "workflow_run_id",
+ "run_number",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "business",
+ "business_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "token_scopes",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Reviewing deployments"
+ },
+ {
+ "action": "workflows.bypass_protection_rules",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "workflow_run_id",
+ "run_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "workflows.comment_workflow_job",
+ "description": "N/A",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "token_id",
+ "hashed_token",
+ "programmatic_access_type",
+ "actor",
+ "actor_id",
+ "workflow_run_id",
+ "run_number",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "org",
+ "org_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type"
+ ]
+ },
+ {
+ "action": "workflows.delete_workflow_run",
+ "description": "A workflow run was deleted.",
+ "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "workflow_run_id",
+ "started_at",
+ "head_branch",
+ "head_sha",
+ "trigger_id",
+ "programmatic_access_type"
+ ],
+ "docs_reference_titles": "Deleting a workflow run"
+ },
+ {
+ "action": "workflows.disable_workflow",
+ "description": "A workflow was disabled.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "workflow_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "workflows.enable_workflow",
+ "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "repo",
+ "repo_id",
+ "workflow_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "workflows.pin_workflow",
+ "description": "A workflow was pinned.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "workflow_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ },
+ {
+ "action": "workflows.reject_workflow_job",
+ "description": "A workflow job was rejected.",
+ "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+ "fields": [
+ "user_agent",
+ "request_id",
+ "actor",
+ "actor_id",
+ "workflow_run_id",
+ "run_number",
+ "user",
+ "user_id",
+ "repo",
+ "repo_id",
+ "action",
+ "operation_type",
+ "@timestamp",
+ "created_at",
+ "_document_id",
+ "public_repo",
+ "programmatic_access_type",
+ "request_access_security_header"
+ ],
+ "docs_reference_titles": "Reviewing deployments"
+ },
+ {
+ "action": "workflows.unpin_workflow",
+ "description": "A workflow was unpinned after previously being pinned.",
+ "docs_reference_links": "N/A",
+ "fields": [
+ "actor",
+ "actor_id",
+ "user_agent",
+ "request_id",
+ "repo",
+ "repo_id",
+ "public_repo",
+ "workflow_id",
+ "org",
+ "org_id",
+ "business",
+ "business_id",
+ "action",
+ "_document_id",
+ "@timestamp",
+ "created_at",
+ "operation_type",
+ "actor_is_bot",
+ "request_access_security_header"
+ ]
+ }
+]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.8/enterprise.json b/src/audit-logs/data/ghes-3.8/enterprise.json
deleted file mode 100644
index 1abfd1c50fac..000000000000
--- a/src/audit-logs/data/ghes-3.8/enterprise.json
+++ /dev/null
@@ -1,88073 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "account_recovery_token.confirm",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "account_recovery_token.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "account_recovery_token.recover",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.update_bill_cycle_day",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.add_admin",
- "description": "An enterprise owner was added to an enterprise.",
- "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.add_organization",
- "description": "An organization was added to an enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_advanced_security.disabled",
- "description": "GitHub Advanced Security was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_advanced_security.disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_advanced_security.enabled",
- "description": "GitHub Advanced Security was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_advanced_security.enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.advanced_security_policy_update",
- "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.advanced_security_repo_admin_enablement_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.clear_actions_settings",
- "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.clear_default_repository_permission",
- "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.clear_members_can_create_repos",
- "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.create",
- "description": "An enterprise was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.dependabot_alerts_repo_admin_enablement_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.disable_two_factor_requirement",
- "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.enable_two_factor_requirement",
- "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.members_can_update_protected_branches.clear",
- "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.remove_admin",
- "description": "An enterprise owner was removed from an enterprise.",
- "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.remove_organization",
- "description": "An organization was removed from an enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.rename_slug",
- "description": "The slug for the enterprise URL was renamed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning_custom_pattern.create",
- "description": "An enterprise-level custom pattern was created for secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning_custom_pattern.delete",
- "description": "An enterprise-level custom pattern was removed from secret scanning.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning_custom_pattern.update",
- "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning.disable",
- "description": "Secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning.disabled_for_new_repos",
- "description": "Secret scanning was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning.enable",
- "description": "Secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning.enabled_for_new_repos",
- "description": "Secret scanning was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.disable",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.enable",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.update",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning_push_protection.disable",
- "description": "Push protection for secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning_push_protection.disabled_for_new_repos",
- "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning_push_protection.enable",
- "description": "Push protection for secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business_secret_scanning_push_protection.enabled_for_new_repos",
- "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.secret_scanning_repo_admin_settings_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.set_actions_fork_pr_approvals_policy",
- "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.set_fork_pr_workflows_policy",
- "description": "The policy for fork pull request workflows was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.update_actions_settings",
- "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.update_default_repository_permission",
- "description": "The base repository permission setting was updated for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.update_member_repository_creation_permission",
- "description": "The repository creation setting was updated for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.update_member_repository_invitation_permission",
- "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise_announcement.create",
- "description": "A global announcement banner was created for the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise_announcement.destroy",
- "description": "A global announcement banner was removed from the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise_announcement.update",
- "description": "A global announcement banner was updated for the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise_domain.approve",
- "description": "A domain was approved for an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise_domain.create",
- "description": "A domain was added to an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise_domain.destroy",
- "description": "A domain was removed from an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise_domain.verify",
- "description": "A domain was verified for an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise.register_self_hosted_runner",
- "description": "A new GitHub Actions self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise.remove_self_hosted_runner",
- "description": "A GitHub Actions self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise.runner_group_created",
- "description": "A GitHub Actions self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise.runner_group_removed",
- "description": "A GitHub Actions self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise.runner_group_runner_removed",
- "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise.runner_group_runners_added",
- "description": "A GitHub Actions self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise.runner_group_runners_updated",
- "description": "A GitHub Actions runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise.runner_group_updated",
- "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise.self_hosted_runner_offline",
- "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise.self_hosted_runner_online",
- "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise.self_hosted_runner_updated",
- "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.create_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.update_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "git.clone",
- "description": "A repository was cloned.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actor",
- "business",
- "hashed_token",
- "org",
- "programmatic_access_type",
- "repo",
- "repository",
- "repository_public",
- "token_id",
- "token_scopes",
- "transport_protocol",
- "transport_protocol_name",
- "user"
- ]
- },
- {
- "action": "git.fetch",
- "description": "Changes were fetched from a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actor",
- "business",
- "hashed_token",
- "org",
- "programmatic_access_type",
- "repo",
- "repository",
- "repository_public",
- "token_id",
- "token_scopes",
- "transport_protocol",
- "transport_protocol_name",
- "user"
- ]
- },
- {
- "action": "git.push",
- "description": "Changes were pushed to a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actor",
- "business",
- "hashed_token",
- "org",
- "programmatic_access_type",
- "repo",
- "repository",
- "repository_public",
- "token_id",
- "token_scopes",
- "transport_protocol",
- "transport_protocol_name",
- "user"
- ]
- },
- {
- "action": "git_signing_ssh_public_key.create",
- "description": "An SSH key was added to a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "git_signing_ssh_public_key.delete",
- "description": "An SSH key was removed from a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "gpg_key.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "gpg_key.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list.disable",
- "description": "An IP allow list was disabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list.disable_for_installed_apps",
- "description": "An IP allow list was disabled for installed GitHub Apps.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list.disable_user_level_enforcement",
- "description": "IP allow list user level enforcement was disabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list.enable",
- "description": "An IP allow list was enabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list.enable_for_installed_apps",
- "description": "An IP allow list was enabled for installed GitHub Apps.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list.enable_user_level_enforcement",
- "description": "IP allow list user level enforcement was enabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list_entry.create",
- "description": "An IP address was added to an IP allow list.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list_entry.destroy",
- "description": "An IP address was deleted from an IP allow list.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list_entry.update",
- "description": "An IP address or its description was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing_plan.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing_plan.publish",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing_plan.retire",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing_plan.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.suspend",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.unsuspend",
- "description": "An OAuth application was unsuspended for a user or organization account.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_authorization.create",
- "description": "An authorization for an OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_authorization.destroy",
- "description": "An authorization for an OAuth application was deleted.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_authorization.update",
- "description": "An authorization for an OAuth application was updated.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.accept_business_invitation",
- "description": "An invitation sent to an organization to join an enterprise was accepted.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.add_billing_manager",
- "description": "A billing manager was added to an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.add_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_policy_selected_member_disabled",
- "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_policy_selected_member_enabled",
- "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.async_delete",
- "description": "A user initiated a background job to delete an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.audit_log_export",
- "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.billing_signup_error",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.block_user",
- "description": "An organization owner blocked a user from accessing the organization's repositories.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.cancel_business_invitation",
- "description": "An invitation for an organization to join an enterprise was revoked",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.cancel_invitation",
- "description": "An invitation sent to a user to join an organization was revoked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.clear_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.confirm_business_invitation",
- "description": "An invitation for an organization to join an enterprise was confirmed.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.create",
- "description": "An organization was created.",
- "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.delete",
- "description": "An organization was deleted by a user-initiated background job.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.disable_member_team_creation_permission",
- "description": "Team creation was limited to owners.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.disable_reader_discussion_creation_permission",
- "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.disable_saml",
- "description": "SAML single sign-on was disabled for an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.disable_two_factor_requirement",
- "description": "A two-factor authentication requirement was disabled for the organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.display_commenter_full_name_disabled",
- "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.display_commenter_full_name_enabled",
- "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.enable_member_team_creation_permission",
- "description": "Team creation by members was allowed.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.enable_reader_discussion_creation_permission",
- "description": "An organization owner allowed users with read access to create discussions in an organization",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.enable_saml",
- "description": "SAML single sign-on was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.enable_two_factor_requirement",
- "description": "Two-factor authentication is now required for the organization.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.integration_manager_added",
- "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.integration_manager_removed",
- "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.invite_member",
- "description": "A new user was invited to join an organization.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.invite_to_business",
- "description": "An organization was invited to join an enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.rate_limited_invites",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.recreate",
- "description": "An organization was restored.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_billing_manager",
- "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_outside_collaborator",
- "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.rename",
- "description": "An organization was renamed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.restore_member",
- "description": "An organization member was restored.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_created",
- "description": "A self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_removed",
- "description": "A self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_runner_removed",
- "description": "The REST API was used to remove a self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_runners_added",
- "description": "A self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_runners_updated",
- "description": "A runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_updated",
- "description": "The configuration of a self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_disabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_enabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_updated",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_disable",
- "description": "Push protection for secret scanning was disabled.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_enable",
- "description": "Push protection for secret scanning was enabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_disable",
- "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_enable",
- "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.transform",
- "description": "A user account was converted into an organization.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.unblock_user",
- "description": "A user was unblocked from an organization.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_actions_settings",
- "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_default_repository_permission",
- "description": "The default repository permission level for organization members was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_saml_provider_settings",
- "description": "An organization's SAML provider settings were updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_terms_of_service",
- "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
- "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_domain.approve",
- "description": "A domain was approved for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_domain.create",
- "description": "A domain was added to an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_domain.destroy",
- "description": "A domain was removed from an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_domain.verify",
- "description": "A domain was verified for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "packages.package_deleted",
- "description": "An entire package was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "packages.package_published",
- "description": "A package was published or republished to an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "packages.package_version_deleted",
- "description": "A specific package version was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "packages.package_version_published",
- "description": "A specific package version was published or republished to a package.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.create",
- "description": "Triggered when you create a fine-grained personal access token.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.credential_regenerated",
- "description": "Triggered when you regenerate a fine-grained personal access token.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.credential_revoked",
- "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
- "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.destroy",
- "description": "Triggered when you delete a fine-grained personal access token.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.update",
- "description": "A fine-grained personal access token was updated.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.authorized_users_teams",
- "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.create",
- "description": "Branch protection was enabled on a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.destroy",
- "description": "Branch protection was disabled on a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.dismiss_stale_reviews",
- "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.dismissal_restricted_users_teams",
- "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.policy_override",
- "description": "A branch protection requirement was overridden by a repository administrator.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "after",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "before",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "compliant_pull_request_ids",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "overridden_codes",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "reasons",
- "referrer",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.rejected_ref_update",
- "description": "A branch update attempt was rejected.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_admin_enforced",
- "description": "Branch protection was enforced for repository administrators.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_allow_deletions_enforcement_level",
- "description": "Branch deletion was enabled or disabled for a protected branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_allow_force_pushes_enforcement_level",
- "description": "Force pushes were enabled or disabled for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_ignore_approvals_from_contributors",
- "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_linear_history_requirement_enforcement_level",
- "description": "Required linear commit history was enabled or disabled for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_lock_allows_fetch_and_merge",
- "description": "Fork syncing was enabled or disabled for a read-only branch",
- "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_lock_branch_enforcement_level",
- "description": "The enforcement of a branch lock was updated.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_name",
- "description": "A branch name pattern was updated for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_pull_request_reviews_enforcement_level",
- "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_require_code_owner_review",
- "description": "Enforcement of required code owner review was updated for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_require_last_push_approval",
- "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_required_approving_review_count",
- "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_required_status_checks_enforcement_level",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_signature_requirement_enforcement_level",
- "description": "Enforcement of required commit signing was updated for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_strict_required_status_checks_policy",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.close",
- "description": "A pull request was closed without being merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.converted_to_draft",
- "description": "A pull request was converted to a draft.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.create",
- "description": "A pull request was created.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.create_review_request",
- "description": "A review was requested on a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.in_progress",
- "description": "A pull request was marked as in progress.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.indirect_merge",
- "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.merge",
- "description": "A pull request was merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.ready_for_review",
- "description": "A pull request was marked as ready for review.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.rebase",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.remove_review_request",
- "description": "A review request was removed from a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.reopen",
- "description": "A pull request was reopened after previously being closed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request_review_comment.create",
- "description": "A review comment was added to a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request_review_comment.delete",
- "description": "A review comment on a pull request was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request_review_comment.update",
- "description": "A review comment on a pull request was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request_review.delete",
- "description": "A review on a pull request was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request_review.dismiss",
- "description": "A review on a pull request was dismissed.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request_review.submit",
- "description": "A review on a pull request was submitted.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.auto_codeql_disabled",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.auto_codeql_enabled",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.create_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.create_integration_secret",
- "description": "An integration secret was created for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.disk_archive",
- "description": "A repository was archived on disk.",
- "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.download_zip",
- "description": "A source code archive of a repository was downloaded as a ZIP file.",
- "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.hide_from_discovery",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.noindex",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.override_unlock",
- "description": "The repository was unlocked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_build",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "An integration secret was deleted for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.require_login",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_integration_secret",
- "description": "An integration secret was updated for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning.disable",
- "description": "Secret scanning was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning.enable",
- "description": "Secret scanning was enabled for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning_push_protection.disable",
- "description": "Secret scanning push protection was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning_push_protection.enable",
- "description": "Secret scanning push protection was enabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "restrict_notification_delivery.disable",
- "description": "Email notification restrictions for an organization or enterprise were disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "restrict_notification_delivery.enable",
- "description": "Email notification restrictions for an organization or enterprise were enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_alert.create",
- "description": "GitHub detected a secret and created a secret scanning alert.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_alert.reopen",
- "description": "A secret scanning alert was reopened.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_alert.resolve",
- "description": "A secret scanning alert was resolved.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_alert.revoke",
- "description": "A secret scanning alert was revoked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning.disable",
- "description": "Secret scanning was disabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning.enable",
- "description": "Secret scanning was enabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_new_repos.disable",
- "description": "Secret scanning was disabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_new_repos.enable",
- "description": "Secret scanning was enabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_push_protection.bypass",
- "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "security_key.register",
- "description": "A security key was registered for an account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "security_key.remove",
- "description": "A security key was removed from an account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_update_newsletter_send",
- "description": "Triggered when you send an email update to your sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.waitlist_join",
- "description": "You join the waitlist to join GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ssh_certificate_authority.create",
- "description": "An SSH certificate authority for an organization or enterprise was created.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ssh_certificate_authority.destroy",
- "description": "An SSH certificate authority for an organization or enterprise was deleted.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ssh_certificate_requirement.disable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ssh_certificate_requirement.enable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "staff.set_domain_token_expiration",
- "description": "The verification code expiry time for an organization or enterprise domain was set.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "staff.unverify_domain",
- "description": "An organization or enterprise domain was unverified.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "staff.verify_domain",
- "description": "An organization or enterprise domain was verified.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "successor_invitation.accept",
- "description": "Triggered when you accept a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "successor_invitation.cancel",
- "description": "Triggered when you cancel a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "successor_invitation.create",
- "description": "Triggered when you create a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "successor_invitation.decline",
- "description": "Triggered when you decline a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "successor_invitation.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "successor_invitation.revoke",
- "description": "Triggered when you revoke a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.add_member",
- "description": "A member of an organization was added to a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.add_repository",
- "description": "A team was given access and permissions to a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.change_parent_team",
- "description": "A child team was created or a child team's parent was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.change_privacy",
- "description": "A team's privacy level was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.create",
- "description": "A new team is created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.demote_maintainer",
- "description": "A user was demoted from a team maintainer to a team member.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.destroy",
- "description": "A team was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.promote_maintainer",
- "description": "A user was promoted from a team member to a team maintainer.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.remove_member",
- "description": "An organization member was removed from a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.remove_repository",
- "description": "A repository was removed from a team's control.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.rename",
- "description": "A team's name was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_sync_tenant.disabled",
- "description": "Team synchronization with a tenant was disabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_sync_tenant.enabled",
- "description": "Team synchronization with a tenant was enabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.update_repository_permission",
- "description": "A team's permission to a repository was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "trusted_device.register",
- "description": "A new trusted device was added.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "trusted_device.remove",
- "description": "A trusted device was removed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.abort",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.complete",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.ignore",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.staff_approve",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.staff_decline",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.start",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.two_factor_destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_authentication.disabled",
- "description": "Two-factor authentication was disabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_authentication.enabled",
- "description": "Two-factor authentication was enabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_authentication.password_reset_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_authentication.recovery_codes_regenerated",
- "description": "Two factor recovery codes were regenerated for a user account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_authentication.sign_in_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_authentication.update_fallback",
- "description": "The two-factor authentication fallback for a user account was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.add_email",
- "description": "An email address was added to a user account.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.async_delete",
- "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.audit_log_export",
- "description": "Audit log entries were exported.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.block_user",
- "description": "A user was blocked by another user.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.change_password",
- "description": "A user changed their password.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.codespaces_trusted_repo_access_granted",
- "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.codespaces_trusted_repo_access_revoked",
- "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.correct_password_from_unrecognized_device",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.correct_password_from_unrecognized_device_and_location",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.correct_password_from_unrecognized_location",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.create",
- "description": "A new user account was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.creation_rate_limit_exceeded",
- "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.delete",
- "description": "A user account was destroyed by an asynchronous job.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.demote",
- "description": "A site administrator was demoted to an ordinary user account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.destroy",
- "description": "A user deleted his or her account, triggering user.async_delete.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.device_verification_failure",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.device_verification_requested",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.device_verification_success",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.disable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.disable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.disable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.enable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.enable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.enable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.failed_login",
- "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.flag_as_large_scale_contributor",
- "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.forgot_password",
- "description": "A user requested a password reset.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.grant_github_developer",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.hide_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.login",
- "description": "A user signed in.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.minimize_comment",
- "description": "A comment made by a user was minimized.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.partial_two_factor_email_followup",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.promote",
- "description": "An ordinary user account was promoted to a site administrator.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.recreate",
- "description": "A user's account was restored.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.remove_email",
- "description": "An email address was removed from a user account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.remove_large_scale_contributor_flag",
- "description": "A user account was no longer flagged as a large scale contributor.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.rename",
- "description": "A username was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.report_abuse",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.report_content",
- "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.reset_password",
- "description": "A user reset their account password.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user_session.country_change",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.show_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.sign_in_from_unrecognized_device",
- "description": "A user signed in from an unrecognized device.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.sign_in_from_unrecognized_device_and_location",
- "description": "A user signed in from an unrecognized device and location.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.sign_in_from_unrecognized_location",
- "description": "A user signed in from an unrecognized location.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user_status.destroy",
- "description": "Triggered when you clear the status on your profile.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user_status.update",
- "description": "Triggered when you set or change the status on your profile.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.suspend",
- "description": "A user account was suspended.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.toggle_warn_private_email",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_challenge_failure",
- "description": "A 2FA challenge issued for a user account failed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_challenge_success",
- "description": "A 2FA challenge issued for a user account succeeded.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_recover",
- "description": "A user used their 2FA recovery codes.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_recovery_codes_downloaded",
- "description": "A user downloaded 2FA recovery codes for their account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_recovery_codes_printed",
- "description": "A user printed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_recovery_codes_viewed",
- "description": "A user viewed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_requested",
- "description": "A user was prompted for a two-factor authentication code.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.unblock_user",
- "description": "A user was unblocked by another user.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.unminimize_comment",
- "description": "A comment made by a user was unminimized.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.unsuspend",
- "description": "A user account was unsuspended.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.update_new_repository_default_branch_setting",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.cancel_workflow_run",
- "description": "A workflow run was cancelled.",
- "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.completed_workflow_run",
- "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.created_workflow_run",
- "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.prepared_workflow_job",
- "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.rerun_workflow_run",
- "description": "A workflow run was re-run.",
- "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.8/organization.json b/src/audit-logs/data/ghes-3.8/organization.json
deleted file mode 100644
index 4475085e0c01..000000000000
--- a/src/audit-logs/data/ghes-3.8/organization.json
+++ /dev/null
@@ -1,80172 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "advisory_credit.accept",
- "description": "Credit was accepted for a security advisory.",
- "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "advisory_credit.create",
- "description": "Someone was added to the credit section of a security advisory.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "advisory_credit.decline",
- "description": "Credit was declined for a security advisory.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "advisory_credit.destroy",
- "description": "Someone was removed from the credit section of a security advisory.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "auto_approve_personal_access_token_requests.disable",
- "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "auto_approve_personal_access_token_requests.enable",
- "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.attempted_to_create_from_prebuild",
- "description": "An attempt to create a codespace from a prebuild was made.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.policy_group_created",
- "description": "Policies were applied to codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.policy_group_deleted",
- "description": "Policies were removed from codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.policy_group_updated",
- "description": "Policies were updated for codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "commit_comment.destroy",
- "description": "A commit comment was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "commit_comment.update",
- "description": "A commit comment was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "discussion_comment.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "discussion_comment.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "discussion.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise_installation.create",
- "description": "The GitHub App associated with a GitHub Connect connection was created.",
- "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "enterprise_installation.destroy",
- "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
- "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.create_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.update_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "git.clone",
- "description": "A repository was cloned.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actor",
- "business",
- "hashed_token",
- "org",
- "programmatic_access_type",
- "repo",
- "repository",
- "repository_public",
- "token_id",
- "token_scopes",
- "transport_protocol",
- "transport_protocol_name",
- "user"
- ]
- },
- {
- "action": "git.fetch",
- "description": "Changes were fetched from a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actor",
- "business",
- "hashed_token",
- "org",
- "programmatic_access_type",
- "repo",
- "repository",
- "repository_public",
- "token_id",
- "token_scopes",
- "transport_protocol",
- "transport_protocol_name",
- "user"
- ]
- },
- {
- "action": "git.push",
- "description": "Changes were pushed to a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actor",
- "business",
- "hashed_token",
- "org",
- "programmatic_access_type",
- "repo",
- "repository",
- "repository_public",
- "token_id",
- "token_scopes",
- "transport_protocol",
- "transport_protocol_name",
- "user"
- ]
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation_request.close",
- "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
- "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation_request.create",
- "description": "A member requested that an owner install a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list.disable",
- "description": "An IP allow list was disabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list.disable_for_installed_apps",
- "description": "An IP allow list was disabled for installed GitHub Apps.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list.enable",
- "description": "An IP allow list was enabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list.enable_for_installed_apps",
- "description": "An IP allow list was enabled for installed GitHub Apps.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list_entry.create",
- "description": "An IP address was added to an IP allow list.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list_entry.destroy",
- "description": "An IP address was deleted from an IP allow list.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ip_allow_list_entry.update",
- "description": "An IP address or its description was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "issue_comment.destroy",
- "description": "A comment on an issue was deleted from the repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "issue_comment.update",
- "description": "A comment on an issue (other than the initial one) changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "issue.destroy",
- "description": "An issue was deleted from the repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "issue.pinned",
- "description": "An issue was pinned to a repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "issue.transfer",
- "description": "An issue was transferred to another repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "issue.unpinned",
- "description": "An issue was unpinned from a repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "issues.deletes_disabled",
- "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "issues.deletes_enabled",
- "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "issues.deletes_policy_cleared",
- "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "members_can_create_pages.disable",
- "description": "The ability for members to publish GitHub Pages sites was disabled.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "members_can_create_pages.enable",
- "description": "The ability for members to publish GitHub Pages sites was enabled.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "members_can_create_private_pages.disable",
- "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "members_can_create_private_pages.enable",
- "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "members_can_create_public_pages.disable",
- "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "members_can_create_public_pages.enable",
- "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "members_can_delete_repos.clear",
- "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "members_can_delete_repos.disable",
- "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "members_can_delete_repos.enable",
- "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "members_can_view_dependency_insights.clear",
- "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "members_can_view_dependency_insights.disable",
- "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "members_can_view_dependency_insights.enable",
- "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "migration.destroy_file",
- "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "migration.download",
- "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.accept_business_invitation",
- "description": "An invitation sent to an organization to join an enterprise was accepted.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.add_billing_manager",
- "description": "A billing manager was added to an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.add_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_policy_selected_member_disabled",
- "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_policy_selected_member_enabled",
- "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled",
- "description": "Third-party application access for outside collaborators was disabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
- "description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.audit_log_export",
- "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.audit_log_git_event_export",
- "description": "An export of the organization's Git events was created.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.billing_signup_error",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.block_user",
- "description": "An organization owner blocked a user from accessing the organization's repositories.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.cancel_business_invitation",
- "description": "An invitation for an organization to join an enterprise was revoked",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.cancel_invitation",
- "description": "An invitation sent to a user to join an organization was revoked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.clear_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.codespaces_trusted_repo_access_granted",
- "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.codespaces_trusted_repo_access_revoked",
- "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.confirm_business_invitation",
- "description": "An invitation for an organization to join an enterprise was confirmed.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.connect_usage_metrics_export",
- "description": "Server statistics were exported for the organization.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.create",
- "description": "An organization was created.",
- "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.create_actions_secret",
- "description": "A GitHub Actions secret was created for an organization.",
- "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.create_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.create_integration_secret",
- "description": "An integration secret was created for an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org_credential_authorization.deauthorize",
- "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
- "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org_credential_authorization.grant",
- "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
- "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org_credential_authorization.revoke",
- "description": "An owner revoked authorized credentials.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.disable_member_team_creation_permission",
- "description": "Team creation was limited to owners.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.disable_oauth_app_restrictions",
- "description": "Third-party application access restrictions for an organization were disabled.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.disable_reader_discussion_creation_permission",
- "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.disable_saml",
- "description": "SAML single sign-on was disabled for an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.disable_two_factor_requirement",
- "description": "A two-factor authentication requirement was disabled for the organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.display_commenter_full_name_disabled",
- "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.display_commenter_full_name_enabled",
- "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.enable_member_team_creation_permission",
- "description": "Team creation by members was allowed.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.enable_oauth_app_restrictions",
- "description": "Third-party application access restrictions for an organization were enabled.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.enable_reader_discussion_creation_permission",
- "description": "An organization owner allowed users with read access to create discussions in an organization",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.enable_saml",
- "description": "SAML single sign-on was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.enable_two_factor_requirement",
- "description": "Two-factor authentication is now required for the organization.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.integration_manager_added",
- "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.integration_manager_removed",
- "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.invite_member",
- "description": "A new user was invited to join an organization.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.invite_to_business",
- "description": "An organization was invited to join an enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.oauth_app_access_approved",
- "description": "Access to an organization was granted for an OAuth App.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.oauth_app_access_denied",
- "description": "Access was disabled for an OAuth App that was previously approved.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.oauth_app_access_requested",
- "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.rate_limited_invites",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_actions_secret",
- "description": "A GitHub Actions secret was removed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_billing_manager",
- "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_integration_secret",
- "description": "An integration secret was removed from an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_outside_collaborator",
- "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.rename",
- "description": "An organization was renamed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.required_workflow_create",
- "description": "Triggered when a required workflow is created.",
- "docs_reference_links": "/actions/using-workflows/required-workflows",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.required_workflow_delete",
- "description": "Triggered when a required workflow is deleted.",
- "docs_reference_links": "/actions/using-workflows/required-workflows",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.required_workflow_update",
- "description": "Triggered when a required workflow is updated.",
- "docs_reference_links": "/actions/using-workflows/required-workflows",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.restore_member",
- "description": "An organization member was restored.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.revoke_external_identity",
- "description": "A member's linked identity was revoked.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.revoke_sso_session",
- "description": "A member's SAML session was revoked.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_created",
- "description": "A self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_removed",
- "description": "A self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_renamed",
- "description": "A self-hosted runner group was renamed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_runner_removed",
- "description": "The REST API was used to remove a self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_runners_added",
- "description": "A self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_runners_updated",
- "description": "A runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_updated",
- "description": "The configuration of a self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.runner_group_visiblity_updated",
- "description": "The visibility of a self-hosted runner group was updated via the REST API.",
- "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_disabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_enabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_updated",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_disable",
- "description": "Push protection for secret scanning was disabled.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_enable",
- "description": "Push protection for secret scanning was enabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_disable",
- "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_enable",
- "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.transfer",
- "description": "An organization was transferred between enterprise accounts.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.transfer_outgoing",
- "description": "An organization was transferred between enterprise accounts.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.unblock_user",
- "description": "A user was unblocked from an organization.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_actions_secret",
- "description": "A GitHub Actions secret was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_actions_settings",
- "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_default_repository_permission",
- "description": "The default repository permission level for organization members was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_integration_secret",
- "description": "An integration secret was updated for an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_new_repository_default_branch_setting",
- "description": "The name of the default branch was changed for new repositories in the organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_saml_provider_settings",
- "description": "An organization's SAML provider settings were updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_terms_of_service",
- "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
- "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_default_label.create",
- "description": "A default label was created for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_default_label.destroy",
- "description": "A default label was deleted for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_default_label.update",
- "description": "A default label was edited for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_domain.approve",
- "description": "A domain was approved for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_domain.create",
- "description": "A domain was added to an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_domain.destroy",
- "description": "A domain was removed from an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_domain.verify",
- "description": "A domain was verified for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_moderators.add_team",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_moderators.add_user",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_moderators.remove_team",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_moderators.remove_user",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_projects_change.clear",
- "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_projects_change.disable",
- "description": "Organization projects were disabled for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "organization_projects_change.enable",
- "description": "Organization projects were enabled for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "packages.package_deleted",
- "description": "An entire package was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "packages.package_published",
- "description": "A package was published or republished to an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "packages.package_version_deleted",
- "description": "A specific package version was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "packages.package_version_published",
- "description": "A specific package version was published or republished to a package.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "prebuild_configuration.create",
- "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "prebuild_configuration.destroy",
- "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "prebuild_configuration.run_triggered",
- "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "prebuild_configuration.update",
- "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "private_repository_forking.clear",
- "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "private_repository_forking.disable",
- "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "private_repository_forking.enable",
- "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.authorized_users_teams",
- "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.create",
- "description": "Branch protection was enabled on a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.destroy",
- "description": "Branch protection was disabled on a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.dismiss_stale_reviews",
- "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.dismissal_restricted_users_teams",
- "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.policy_override",
- "description": "A branch protection requirement was overridden by a repository administrator.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "after",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "before",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "compliant_pull_request_ids",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "overridden_codes",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "reasons",
- "referrer",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.rejected_ref_update",
- "description": "A branch update attempt was rejected.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_admin_enforced",
- "description": "Branch protection was enforced for repository administrators.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_allow_deletions_enforcement_level",
- "description": "Branch deletion was enabled or disabled for a protected branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_allow_force_pushes_enforcement_level",
- "description": "Force pushes were enabled or disabled for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_ignore_approvals_from_contributors",
- "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_linear_history_requirement_enforcement_level",
- "description": "Required linear commit history was enabled or disabled for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_lock_allows_fetch_and_merge",
- "description": "Fork syncing was enabled or disabled for a read-only branch",
- "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_lock_branch_enforcement_level",
- "description": "The enforcement of a branch lock was updated.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_name",
- "description": "A branch name pattern was updated for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_pull_request_reviews_enforcement_level",
- "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_require_code_owner_review",
- "description": "Enforcement of required code owner review was updated for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_require_last_push_approval",
- "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_required_approving_review_count",
- "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_required_status_checks_enforcement_level",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_signature_requirement_enforcement_level",
- "description": "Enforcement of required commit signing was updated for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "protected_branch.update_strict_required_status_checks_policy",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.close",
- "description": "A pull request was closed without being merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.converted_to_draft",
- "description": "A pull request was converted to a draft.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.create",
- "description": "A pull request was created.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.create_review_request",
- "description": "A review was requested on a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.in_progress",
- "description": "A pull request was marked as in progress.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.indirect_merge",
- "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.merge",
- "description": "A pull request was merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.ready_for_review",
- "description": "A pull request was marked as ready for review.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.rebase",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.remove_review_request",
- "description": "A review request was removed from a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request.reopen",
- "description": "A pull request was reopened after previously being closed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request_review_comment.create",
- "description": "A review comment was added to a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request_review_comment.delete",
- "description": "A review comment on a pull request was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request_review_comment.update",
- "description": "A review comment on a pull request was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request_review.delete",
- "description": "A review on a pull request was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request_review.dismiss",
- "description": "A review on a pull request was dismissed.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pull_request_review.submit",
- "description": "A review on a pull request was submitted.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.auto_codeql_disabled",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.auto_codeql_enabled",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.codespaces_trusted_repo_access_granted",
- "description": "GitHub Codespaces was granted trusted repository access to this repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.codespaces_trusted_repo_access_revoked",
- "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.create_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.create_integration_secret",
- "description": "An integration secret was created for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.download_zip",
- "description": "A source code archive of a repository was downloaded as a ZIP file.",
- "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "An integration secret was deleted for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.rename_branch",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_integration_secret",
- "description": "An integration secret was updated for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_advisory.close",
- "description": "Someone closed a security advisory.",
- "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_advisory.cve_request",
- "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_advisory.github_broadcast",
- "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_advisory.github_withdraw",
- "description": "GitHub withdrew a security advisory that was published in error.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_advisory.open",
- "description": "Someone opened a draft security advisory.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_advisory.publish",
- "description": "Someone published a security advisory.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_advisory.reopen",
- "description": "Someone reopened as draft security advisory.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_advisory.update",
- "description": "Someone edited a draft or published security advisory.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_content_analysis.disable",
- "description": "Data use settings were disabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_content_analysis.enable",
- "description": "Data use settings were enabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_dependency_graph.disable",
- "description": "The dependency graph was disabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_dependency_graph.enable",
- "description": "The dependency graph was enabled for a private repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_projects_change.clear",
- "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_projects_change.disable",
- "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_projects_change.enable",
- "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning.disable",
- "description": "Secret scanning was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning.enable",
- "description": "Secret scanning was enabled for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning_push_protection.disable",
- "description": "Secret scanning push protection was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_secret_scanning_push_protection.enable",
- "description": "Secret scanning push protection was enabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_visibility_change.clear",
- "description": "The repository visibility change setting was cleared for an organization or enterprise.",
- "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_visibility_change.disable",
- "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_visibility_change.enable",
- "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_vulnerability_alert.create",
- "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_vulnerability_alert.dismiss",
- "description": "A Dependabot alert was manually dismissed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_vulnerability_alert.reintroduce",
- "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_vulnerability_alert.reopen",
- "description": "A Dependabot alert was manually reopened.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_vulnerability_alert.resolve",
- "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_vulnerability_alerts.authorized_users_teams",
- "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_vulnerability_alerts.disable",
- "description": "Dependabot alerts was disabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_vulnerability_alerts.enable",
- "description": "Dependabot alerts was enabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "required_status_check.create",
- "description": "A status check was marked as required for a protected branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "required_status_check.destroy",
- "description": "A status check was no longer marked as required for a protected branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "restrict_notification_delivery.disable",
- "description": "Email notification restrictions for an organization or enterprise were disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "restrict_notification_delivery.enable",
- "description": "Email notification restrictions for an organization or enterprise were enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "role.create",
- "description": "A new custom repository role was created.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "role.destroy",
- "description": "A custom repository role was deleted.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "role.update",
- "description": "A custom repository role was edited.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_alert.create",
- "description": "GitHub detected a secret and created a secret scanning alert.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_alert.reopen",
- "description": "A secret scanning alert was reopened.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_alert.resolve",
- "description": "A secret scanning alert was resolved.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_alert.revoke",
- "description": "A secret scanning alert was revoked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning.disable",
- "description": "Secret scanning was disabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning.enable",
- "description": "Secret scanning was enabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_new_repos.disable",
- "description": "Secret scanning was disabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_new_repos.enable",
- "description": "Secret scanning was enabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "secret_scanning_push_protection.bypass",
- "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ssh_certificate_authority.create",
- "description": "An SSH certificate authority for an organization or enterprise was created.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ssh_certificate_authority.destroy",
- "description": "An SSH certificate authority for an organization or enterprise was deleted.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ssh_certificate_requirement.disable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "ssh_certificate_requirement.enable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "staff.set_domain_token_expiration",
- "description": "The verification code expiry time for an organization or enterprise domain was set.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "staff.unverify_domain",
- "description": "An organization or enterprise domain was unverified.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "staff.verify_domain",
- "description": "An organization or enterprise domain was verified.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.add_member",
- "description": "A member of an organization was added to a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.add_repository",
- "description": "A team was given access and permissions to a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.change_parent_team",
- "description": "A child team was created or a child team's parent was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.change_privacy",
- "description": "A team's privacy level was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.create",
- "description": "A new team is created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.demote_maintainer",
- "description": "A user was demoted from a team maintainer to a team member.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.destroy",
- "description": "A team was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_group_mapping.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_group_mapping.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_group_mapping.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.promote_maintainer",
- "description": "A user was promoted from a team member to a team maintainer.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.remove_member",
- "description": "An organization member was removed from a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.remove_repository",
- "description": "A repository was removed from a team's control.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.rename",
- "description": "A team's name was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_sync_tenant.disabled",
- "description": "Team synchronization with a tenant was disabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_sync_tenant.enabled",
- "description": "Team synchronization with a tenant was enabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team_sync_tenant.update_okta_credentials",
- "description": "The Okta credentials for team synchronization with a tenant were changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "team.update_repository_permission",
- "description": "A team's permission to a repository was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.cancel_workflow_run",
- "description": "A workflow run was cancelled.",
- "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.completed_workflow_run",
- "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.created_workflow_run",
- "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.prepared_workflow_job",
- "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.rerun_workflow_run",
- "description": "A workflow run was re-run.",
- "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.8/user.json b/src/audit-logs/data/ghes-3.8/user.json
deleted file mode 100644
index fbe109f3adf1..000000000000
--- a/src/audit-logs/data/ghes-3.8/user.json
+++ /dev/null
@@ -1,47274 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "account_recovery_token.confirm",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "account_recovery_token.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "account_recovery_token.recover",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "billing.update_bill_cycle_day",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.set_actions_fork_pr_approvals_policy",
- "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "business.set_fork_pr_workflows_policy",
- "description": "The policy for fork pull request workflows was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.create_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.update_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "git_signing_ssh_public_key.create",
- "description": "An SSH key was added to a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "git_signing_ssh_public_key.delete",
- "description": "An SSH key was removed from a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "gpg_key.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "gpg_key.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing_plan.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing_plan.publish",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing_plan.retire",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing_plan.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_authorization.create",
- "description": "An authorization for an OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "oauth_authorization.destroy",
- "description": "An authorization for an OAuth application was deleted.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.create",
- "description": "Triggered when you create a fine-grained personal access token.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.credential_regenerated",
- "description": "Triggered when you regenerate a fine-grained personal access token.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.credential_revoked",
- "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
- "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.destroy",
- "description": "Triggered when you delete a fine-grained personal access token.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "personal_access_token.update",
- "description": "A fine-grained personal access token was updated.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.create_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.create_integration_secret",
- "description": "An integration secret was created for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "An integration secret was deleted for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_actions_variable",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_integration_secret",
- "description": "An integration secret was updated for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "security_key.register",
- "description": "A security key was registered for an account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "security_key.remove",
- "description": "A security key was removed from an account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.sponsored_developer_update_newsletter_send",
- "description": "Triggered when you send an email update to your sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.waitlist_join",
- "description": "You join the waitlist to join GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "successor_invitation.accept",
- "description": "Triggered when you accept a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "successor_invitation.cancel",
- "description": "Triggered when you cancel a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "successor_invitation.create",
- "description": "Triggered when you create a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "successor_invitation.decline",
- "description": "Triggered when you decline a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "successor_invitation.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "successor_invitation.revoke",
- "description": "Triggered when you revoke a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "trusted_device.register",
- "description": "A new trusted device was added.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "trusted_device.remove",
- "description": "A trusted device was removed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.abort",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.complete",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.ignore",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.staff_approve",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.staff_decline",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.start",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_account_recovery.two_factor_destroy",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_authentication.disabled",
- "description": "Two-factor authentication was disabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_authentication.enabled",
- "description": "Two-factor authentication was enabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_authentication.password_reset_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_authentication.recovery_codes_regenerated",
- "description": "Two factor recovery codes were regenerated for a user account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_authentication.sign_in_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "two_factor_authentication.update_fallback",
- "description": "The two-factor authentication fallback for a user account was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.add_email",
- "description": "An email address was added to a user account.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.async_delete",
- "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.audit_log_export",
- "description": "Audit log entries were exported.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.block_user",
- "description": "A user was blocked by another user.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.change_password",
- "description": "A user changed their password.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.codespaces_trusted_repo_access_granted",
- "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.codespaces_trusted_repo_access_revoked",
- "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.create",
- "description": "A new user account was created.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.creation_rate_limit_exceeded",
- "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.delete",
- "description": "A user account was destroyed by an asynchronous job.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.demote",
- "description": "A site administrator was demoted to an ordinary user account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.destroy",
- "description": "A user deleted his or her account, triggering user.async_delete.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.device_verification_failure",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.device_verification_requested",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.device_verification_success",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.disable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.disable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.disable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.enable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.enable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.enable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.failed_login",
- "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.forgot_password",
- "description": "A user requested a password reset.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.grant_github_developer",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.hide_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.login",
- "description": "A user signed in.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.promote",
- "description": "An ordinary user account was promoted to a site administrator.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.recreate",
- "description": "A user's account was restored.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.remove_email",
- "description": "An email address was removed from a user account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.rename",
- "description": "A username was changed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.reset_password",
- "description": "A user reset their account password.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user_session.country_change",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.show_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user_status.destroy",
- "description": "Triggered when you clear the status on your profile.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user_status.update",
- "description": "Triggered when you set or change the status on your profile.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.suspend",
- "description": "A user account was suspended.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.toggle_warn_private_email",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_challenge_failure",
- "description": "A 2FA challenge issued for a user account failed.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_challenge_success",
- "description": "A 2FA challenge issued for a user account succeeded.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_recover",
- "description": "A user used their 2FA recovery codes.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_recovery_codes_downloaded",
- "description": "A user downloaded 2FA recovery codes for their account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_recovery_codes_printed",
- "description": "A user printed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_recovery_codes_viewed",
- "description": "A user viewed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.two_factor_requested",
- "description": "A user was prompted for a two-factor authentication code.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.unblock_user",
- "description": "A user was unblocked by another user.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.unsuspend",
- "description": "A user account was unsuspended.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "user.update_new_repository_default_branch_setting",
- "description": "N/A",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
- "fields": [
- "@timestamp",
- "_document_id",
- "action",
- "actions_cache_id",
- "actions_cache_key",
- "actions_cache_scope",
- "actions_cache_version",
- "active",
- "active_was",
- "actor",
- "admin_enforced",
- "alert_number",
- "allow_deletions_enforcement_level",
- "allow_force_pushes_enforcement_level",
- "authorized_actor_names",
- "base_role",
- "blocked_user",
- "branch",
- "business",
- "calling_workflow_refs",
- "calling_workflow_shas",
- "cancelled_at",
- "check_run_id",
- "completed_at",
- "conclusion",
- "config",
- "config_was",
- "content_type",
- "create_protected",
- "created_at",
- "credential_regenerated",
- "credential_revoked",
- "custom_pattern",
- "deploy_key_fingerprint",
- "dismiss_comment",
- "dismiss_reason",
- "dismiss_stale_reviews_on_push",
- "emoji",
- "enforcement_level",
- "environment_name",
- "event",
- "events",
- "events_were",
- "explanation",
- "fingerprint",
- "from_business",
- "ghsa_id",
- "hashed_token",
- "head_branch",
- "head_sha",
- "hook_id",
- "ignore_approvals_from_contributors",
- "imposer_repo",
- "imposer_workflow_sha",
- "invitee_email",
- "is_hosted_runner",
- "job_name",
- "job_workflow_ref",
- "key",
- "limited_availability",
- "linear_history_requirement_enforcement_level",
- "lock_allows_fetch_and_merge",
- "lock_branch_enforcement_level",
- "merge_queue_enforcement_level",
- "message",
- "name",
- "new_repo_base_role",
- "new_repo_permission",
- "number",
- "oauth_application",
- "oauth_application_id",
- "old_base_role",
- "old_message",
- "old_name",
- "old_permission",
- "old_permissions",
- "old_repo_base_role",
- "old_repo_permission",
- "old_role_permissions",
- "old_user",
- "openssh_public_key",
- "operation_type",
- "org",
- "organization_upgrade",
- "origin_repository",
- "owner",
- "owner_type",
- "permission",
- "previous_visibility",
- "programmatic_access_type",
- "public_repo",
- "pull_request_id",
- "pull_request_reviews_enforcement_level",
- "pull_request_title",
- "pull_request_url",
- "read_only",
- "repo",
- "repositories_added",
- "repositories_added_names",
- "repositories_removed",
- "repositories_removed_names",
- "repository_selection",
- "request_cancelled",
- "requested_permissions",
- "require_code_owner_review",
- "require_code_owner_review",
- "require_last_push_approval",
- "required_approving_review_count",
- "required_approving_review_count",
- "required_deployments_enforcement_level",
- "required_review_thread_resolution_enforcement_level",
- "required_status_checks_enforcement_level",
- "rerun_type",
- "resolution",
- "revoked_permissions",
- "role_permissions",
- "run_attempt",
- "run_number",
- "runner_group_allow_public",
- "runner_group_id",
- "runner_group_name",
- "runner_group_restricted_to_workflows",
- "runner_group_selected_workflow_refs",
- "runner_id",
- "runner_labels",
- "runner_name",
- "runner_owner_type",
- "secrets_passed",
- "signature_requirement_enforcement_level",
- "source_version",
- "started_at",
- "strict_required_status_checks_policy",
- "target_login",
- "target_version",
- "team",
- "to_business",
- "token_id",
- "token_scopes",
- "topic",
- "trigger_id",
- "user",
- "user",
- "visibility",
- "workflow_id",
- "workflow_run_id"
- ]
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.9/enterprise.json b/src/audit-logs/data/ghes-3.9/enterprise.json
deleted file mode 100644
index 278a7b8830ea..000000000000
--- a/src/audit-logs/data/ghes-3.9/enterprise.json
+++ /dev/null
@@ -1,3147 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "account_recovery_token.confirm",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.recover",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "api.request",
- "description": "An API request was made to a security-significant endpoint for the enterprise. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.update_bill_cycle_day",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.add_admin",
- "description": "An enterprise owner was added to an enterprise.",
- "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise"
- },
- {
- "action": "business.add_organization",
- "description": "An organization was added to an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_advanced_security.disabled",
- "description": "GitHub Advanced Security was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.enabled",
- "description": "GitHub Advanced Security was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_advanced_security.enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business.advanced_security_policy_update",
- "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise"
- },
- {
- "action": "business.advanced_security_repo_admin_enablement_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.clear_actions_settings",
- "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise"
- },
- {
- "action": "business.clear_default_repository_permission",
- "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions"
- },
- {
- "action": "business.clear_members_can_create_repos",
- "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation"
- },
- {
- "action": "business.create",
- "description": "An enterprise was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.dependabot_alerts_repo_admin_enablement_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.disable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise"
- },
- {
- "action": "business.disable_two_factor_requirement",
- "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.enable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise"
- },
- {
- "action": "business.enable_two_factor_requirement",
- "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.clear",
- "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.remove_admin",
- "description": "An enterprise owner was removed from an enterprise.",
- "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise"
- },
- {
- "action": "business.remove_organization",
- "description": "An organization was removed from an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.rename_slug",
- "description": "The slug for the enterprise URL was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_custom_pattern.create",
- "description": "An enterprise-level custom pattern was created for secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern.delete",
- "description": "An enterprise-level custom pattern was removed from secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account"
- },
- {
- "action": "business_secret_scanning_custom_pattern.update",
- "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business_secret_scanning.disable",
- "description": "Secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.disabled_for_new_repos",
- "description": "Secret scanning was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.enable",
- "description": "Secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning.enabled_for_new_repos",
- "description": "Secret scanning was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.disable",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.enable",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection_custom_message.update",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.disable",
- "description": "Push protection for secret scanning was disabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.disabled_for_new_repos",
- "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.enable",
- "description": "Push protection for secret scanning was enabled for your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business_secret_scanning_push_protection.enabled_for_new_repos",
- "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
- "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
- },
- {
- "action": "business.secret_scanning_repo_admin_settings_policy_update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.set_actions_fork_pr_approvals_policy",
- "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories"
- },
- {
- "action": "business.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise"
- },
- {
- "action": "business.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise"
- },
- {
- "action": "business.set_fork_pr_workflows_policy",
- "description": "The policy for fork pull request workflows was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "business.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.update_actions_settings",
- "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise"
- },
- {
- "action": "business.update_default_repository_permission",
- "description": "The base repository permission setting was updated for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions"
- },
- {
- "action": "business.update_member_repository_creation_permission",
- "description": "The repository creation setting was updated for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation"
- },
- {
- "action": "business.update_member_repository_invitation_permission",
- "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "enterprise_announcement.create",
- "description": "A global announcement banner was created for the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner"
- },
- {
- "action": "enterprise_announcement.destroy",
- "description": "A global announcement banner was removed from the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise"
- },
- {
- "action": "enterprise_announcement.update",
- "description": "A global announcement banner was updated for the enterprise.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise"
- },
- {
- "action": "enterprise_domain.approve",
- "description": "A domain was approved for an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise_domain.create",
- "description": "A domain was added to an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise_domain.destroy",
- "description": "A domain was removed from an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain"
- },
- {
- "action": "enterprise_domain.verify",
- "description": "A domain was verified for an enterprise.",
- "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account"
- },
- {
- "action": "enterprise.register_self_hosted_runner",
- "description": "A new GitHub Actions self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "enterprise.remove_self_hosted_runner",
- "description": "A GitHub Actions self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "enterprise.runner_group_created",
- "description": "A GitHub Actions self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "enterprise.runner_group_removed",
- "description": "A GitHub Actions self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "enterprise.runner_group_runner_removed",
- "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "enterprise.runner_group_runners_added",
- "description": "A GitHub Actions self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "enterprise.runner_group_runners_updated",
- "description": "A GitHub Actions runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "enterprise.runner_group_updated",
- "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "enterprise.self_hosted_runner_offline",
- "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "enterprise.self_hosted_runner_online",
- "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "enterprise.self_hosted_runner_updated",
- "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "git.clone",
- "description": "A repository was cloned.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.fetch",
- "description": "Changes were fetched from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.push",
- "description": "Changes were pushed to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git_signing_ssh_public_key.create",
- "description": "An SSH key was added to a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "git_signing_ssh_public_key.delete",
- "description": "An SSH key was removed from a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "ip_allow_list.disable",
- "description": "An IP allow list was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_for_installed_apps",
- "description": "An IP allow list was disabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_user_level_enforcement",
- "description": "IP allow list user level enforcement was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable",
- "description": "An IP allow list was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_for_installed_apps",
- "description": "An IP allow list was enabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_user_level_enforcement",
- "description": "IP allow list user level enforcement was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.create",
- "description": "An IP address was added to an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.destroy",
- "description": "An IP address was deleted from an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.update",
- "description": "An IP address or its description was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.publish",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.retire",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.suspend",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.unsuspend",
- "description": "An OAuth application was unsuspended for a user or organization account.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_authorization.create",
- "description": "An authorization for an OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_authorization.destroy",
- "description": "An authorization for an OAuth application was deleted.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations"
- },
- {
- "action": "oauth_authorization.update",
- "description": "An authorization for an OAuth application was updated.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "org.accept_business_invitation",
- "description": "An invitation sent to an organization to join an enterprise was accepted.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.add_billing_manager",
- "description": "A billing manager was added to an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_policy_selected_member_disabled",
- "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.advanced_security_policy_selected_member_enabled",
- "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.async_delete",
- "description": "A user initiated a background job to delete an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.audit_log_export",
- "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
- },
- {
- "action": "org.billing_signup_error",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.block_user",
- "description": "An organization owner blocked a user from accessing the organization's repositories.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
- },
- {
- "action": "org.cancel_business_invitation",
- "description": "An invitation for an organization to join an enterprise was revoked",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.cancel_invitation",
- "description": "An invitation sent to a user to join an organization was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.clear_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.confirm_business_invitation",
- "description": "An invitation for an organization to join an enterprise was confirmed.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.create",
- "description": "An organization was created.",
- "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
- },
- {
- "action": "org.delete",
- "description": "An organization was deleted by a user-initiated background job.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_member_team_creation_permission",
- "description": "Team creation was limited to owners.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.disable_reader_discussion_creation_permission",
- "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.disable_saml",
- "description": "SAML single sign-on was disabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_two_factor_requirement",
- "description": "A two-factor authentication requirement was disabled for the organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_disabled",
- "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_enabled",
- "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.enable_member_team_creation_permission",
- "description": "Team creation by members was allowed.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.enable_reader_discussion_creation_permission",
- "description": "An organization owner allowed users with read access to create discussions in an organization",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.enable_saml",
- "description": "SAML single sign-on was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization"
- },
- {
- "action": "org.enable_two_factor_requirement",
- "description": "Two-factor authentication is now required for the organization.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.integration_manager_added",
- "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.integration_manager_removed",
- "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.invite_member",
- "description": "A new user was invited to join an organization.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
- },
- {
- "action": "org.invite_to_business",
- "description": "An organization was invited to join an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.rate_limited_invites",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.recreate",
- "description": "An organization was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization"
- },
- {
- "action": "org.remove_billing_manager",
- "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_outside_collaborator",
- "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization"
- },
- {
- "action": "org.rename",
- "description": "An organization was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.restore_member",
- "description": "An organization member was restored.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
- },
- {
- "action": "org.runner_group_created",
- "description": "A self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org.runner_group_removed",
- "description": "A self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_runner_removed",
- "description": "The REST API was used to remove a self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_runners_added",
- "description": "A self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "org.runner_group_runners_updated",
- "description": "A runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_updated",
- "description": "The configuration of a self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_disabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_enabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_updated",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_disable",
- "description": "Push protection for secret scanning was disabled.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "org.secret_scanning_push_protection_enable",
- "description": "Push protection for secret scanning was enabled.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_disable",
- "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_enable",
- "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.transform",
- "description": "A user account was converted into an organization.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization"
- },
- {
- "action": "org.unblock_user",
- "description": "A user was unblocked from an organization.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
- },
- {
- "action": "org.update_actions_settings",
- "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
- },
- {
- "action": "org.update_default_repository_permission",
- "description": "The default repository permission level for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "org.update_saml_provider_settings",
- "description": "An organization's SAML provider settings were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_terms_of_service",
- "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
- "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
- },
- {
- "action": "organization_domain.approve",
- "description": "A domain was approved for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.create",
- "description": "A domain was added to an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.destroy",
- "description": "A domain was removed from an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain"
- },
- {
- "action": "organization_domain.verify",
- "description": "A domain was verified for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "packages.package_deleted",
- "description": "An entire package was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_published",
- "description": "A package was published or republished to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "packages.package_version_deleted",
- "description": "A specific package version was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_version_published",
- "description": "A specific package version was published or republished to a package.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "passkey.register",
- "description": "A new passkey was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "passkey.remove",
- "description": "A new passkey was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.create",
- "description": "Triggered when you create a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_regenerated",
- "description": "Triggered when you regenerate a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_revoked",
- "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
- "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users"
- },
- {
- "action": "personal_access_token.destroy",
- "description": "Triggered when you delete a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.update",
- "description": "A fine-grained personal access token was updated.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.authorized_users_teams",
- "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
- },
- {
- "action": "protected_branch.create",
- "description": "Branch protection was enabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.destroy",
- "description": "Branch protection was disabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismiss_stale_reviews",
- "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismissal_restricted_users_teams",
- "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.policy_override",
- "description": "A branch protection requirement was overridden by a repository administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.rejected_ref_update",
- "description": "A branch update attempt was rejected.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_admin_enforced",
- "description": "Branch protection was enforced for repository administrators.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_deletions_enforcement_level",
- "description": "Branch deletion was enabled or disabled for a protected branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_force_pushes_enforcement_level",
- "description": "Force pushes were enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_ignore_approvals_from_contributors",
- "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "protected_branch.update_linear_history_requirement_enforcement_level",
- "description": "Required linear commit history was enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_lock_allows_fetch_and_merge",
- "description": "Fork syncing was enabled or disabled for a read-only branch",
- "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_lock_branch_enforcement_level",
- "description": "The enforcement of a branch lock was updated.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "protected_branch.update_name",
- "description": "A branch name pattern was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_pull_request_reviews_enforcement_level",
- "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_code_owner_review",
- "description": "Enforcement of required code owner review was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_last_push_approval",
- "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
- },
- {
- "action": "protected_branch.update_required_approving_review_count",
- "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_required_status_checks_enforcement_level",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_signature_requirement_enforcement_level",
- "description": "Enforcement of required commit signing was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_strict_required_status_checks_policy",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "pull_request.close",
- "description": "A pull request was closed without being merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
- },
- {
- "action": "pull_request.converted_to_draft",
- "description": "A pull request was converted to a draft.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
- },
- {
- "action": "pull_request.create",
- "description": "A pull request was created.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request"
- },
- {
- "action": "pull_request.create_review_request",
- "description": "A review was requested on a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.in_progress",
- "description": "A pull request was marked as in progress.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.indirect_merge",
- "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.merge",
- "description": "A pull request was merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
- },
- {
- "action": "pull_request.ready_for_review",
- "description": "A pull request was marked as ready for review.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
- },
- {
- "action": "pull_request.rebase",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.remove_review_request",
- "description": "A review request was removed from a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.reopen",
- "description": "A pull request was reopened after previously being closed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.create",
- "description": "A review comment was added to a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request_review_comment.delete",
- "description": "A review comment on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.update",
- "description": "A review comment on a pull request was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.delete",
- "description": "A review on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.dismiss",
- "description": "A review on a pull request was dismissed.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
- },
- {
- "action": "pull_request_review.submit",
- "description": "A review on a pull request was submitted.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.disk_archive",
- "description": "A repository was archived on disk.",
- "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories"
- },
- {
- "action": "repo.download_zip",
- "description": "A source code archive of a repository was downloaded as a ZIP file.",
- "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives"
- },
- {
- "action": "repo.hide_from_discovery",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.noindex",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.override_unlock",
- "description": "The repository was unlocked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_build",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.require_login",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning.disable",
- "description": "Secret scanning was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "repository_secret_scanning.enable",
- "description": "Secret scanning was enabled for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_push_protection.disable",
- "description": "Secret scanning push protection was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_secret_scanning_push_protection.enable",
- "description": "Secret scanning push protection was enabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "restrict_notification_delivery.disable",
- "description": "Email notification restrictions for an organization or enterprise were disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "restrict_notification_delivery.enable",
- "description": "Email notification restrictions for an organization or enterprise were enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "secret_scanning_alert.create",
- "description": "GitHub detected a secret and created a secret scanning alert.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
- },
- {
- "action": "secret_scanning_alert.reopen",
- "description": "A secret scanning alert was reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.resolve",
- "description": "A secret scanning alert was resolved.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.revoke",
- "description": "A secret scanning alert was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning.disable",
- "description": "Secret scanning was disabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning.enable",
- "description": "Secret scanning was enabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.disable",
- "description": "Secret scanning was disabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.enable",
- "description": "Secret scanning was enabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_push_protection.bypass",
- "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret"
- },
- {
- "action": "security_key.register",
- "description": "A security key was registered for an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "security_key.remove",
- "description": "A security key was removed from an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.sponsored_developer_update_newsletter_send",
- "description": "Triggered when you send an email update to your sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.waitlist_join",
- "description": "You join the waitlist to join GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ssh_certificate_authority.create",
- "description": "An SSH certificate authority for an organization or enterprise was created.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_authority.destroy",
- "description": "An SSH certificate authority for an organization or enterprise was deleted.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.disable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.enable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "staff.set_domain_token_expiration",
- "description": "The verification code expiry time for an organization or enterprise domain was set.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.unverify_domain",
- "description": "An organization or enterprise domain was unverified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.verify_domain",
- "description": "An organization or enterprise domain was verified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.accept",
- "description": "Triggered when you accept a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.cancel",
- "description": "Triggered when you cancel a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.create",
- "description": "Triggered when you create a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.decline",
- "description": "Triggered when you decline a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.revoke",
- "description": "Triggered when you revoke a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "team.add_member",
- "description": "A member of an organization was added to a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
- },
- {
- "action": "team.add_repository",
- "description": "A team was given access and permissions to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.change_parent_team",
- "description": "A child team was created or a child team's parent was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
- },
- {
- "action": "team.change_privacy",
- "description": "A team's privacy level was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility"
- },
- {
- "action": "team.create",
- "description": "A new team is created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.demote_maintainer",
- "description": "A user was demoted from a team maintainer to a team member.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
- },
- {
- "action": "team.destroy",
- "description": "A team was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization"
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.promote_maintainer",
- "description": "A user was promoted from a team member to a team maintainer.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
- },
- {
- "action": "team.remove_member",
- "description": "An organization member was removed from a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
- },
- {
- "action": "team.remove_repository",
- "description": "A repository was removed from a team's control.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.rename",
- "description": "A team's name was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_sync_tenant.disabled",
- "description": "Team synchronization with a tenant was disabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.enabled",
- "description": "Team synchronization with a tenant was enabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team.update_repository_permission",
- "description": "A team's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.register",
- "description": "A new trusted device was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.remove",
- "description": "A trusted device was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.abort",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.complete",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.ignore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_approve",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_decline",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.start",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.two_factor_destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.add_factor",
- "description": "A secondary authentication factor was added to a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.disabled",
- "description": "Two-factor authentication was disabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account"
- },
- {
- "action": "two_factor_authentication.enabled",
- "description": "Two-factor authentication was enabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.password_reset_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.recovery_codes_regenerated",
- "description": "Two factor recovery codes were regenerated for a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.remove_factor",
- "description": "A secondary authentication factor was removed from a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.sign_in_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.update_fallback",
- "description": "The two-factor authentication fallback for a user account was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.add_email",
- "description": "An email address was added to a user account.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account"
- },
- {
- "action": "user.async_delete",
- "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.audit_log_export",
- "description": "Audit log entries were exported.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.block_user",
- "description": "A user was blocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.change_password",
- "description": "A user changed their password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.codespaces_trusted_repo_access_granted",
- "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.codespaces_trusted_repo_access_revoked",
- "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.correct_password_from_unrecognized_device",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.correct_password_from_unrecognized_device_and_location",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.correct_password_from_unrecognized_location",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create",
- "description": "A new user account was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create_integration_secret",
- "description": "A user secret for Codespaces was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.creation_rate_limit_exceeded",
- "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.delete",
- "description": "A user account was destroyed by an asynchronous job.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.demote",
- "description": "A site administrator was demoted to an ordinary user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.destroy",
- "description": "A user deleted his or her account, triggering user.async_delete.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_failure",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_requested",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_success",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.failed_login",
- "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.flag_as_large_scale_contributor",
- "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.forgot_password",
- "description": "A user requested a password reset.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
- },
- {
- "action": "user.grant_github_developer",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.hide_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.login",
- "description": "A user signed in.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.minimize_comment",
- "description": "A comment made by a user was minimized.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.new_device_used",
- "description": "A user signed in from a new device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.partial_two_factor_email_followup",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.promote",
- "description": "An ordinary user account was promoted to a site administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.recreate",
- "description": "A user's account was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_email",
- "description": "An email address was removed from a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_integration_secret",
- "description": "A user secret for Codespaces was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_large_scale_contributor_flag",
- "description": "A user account was no longer flagged as a large scale contributor.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.rename",
- "description": "A username was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.report_abuse",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.report_content",
- "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam"
- },
- {
- "action": "user.reset_password",
- "description": "A user reset their account password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_session.country_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.show_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.sign_in_from_unrecognized_device",
- "description": "A user signed in from an unrecognized device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_device_and_location",
- "description": "A user signed in from an unrecognized device and location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_location",
- "description": "A user signed in from an unrecognized location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.destroy",
- "description": "Triggered when you clear the status on your profile.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.update",
- "description": "Triggered when you set or change the status on your profile.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status"
- },
- {
- "action": "user.suspend",
- "description": "A user account was suspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.toggle_warn_private_email",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_failure",
- "description": "A 2FA challenge issued for a user account failed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_success",
- "description": "A 2FA challenge issued for a user account succeeded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recover",
- "description": "A user used their 2FA recovery codes.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_downloaded",
- "description": "A user downloaded 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_printed",
- "description": "A user printed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_viewed",
- "description": "A user viewed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_requested",
- "description": "A user was prompted for a two-factor authentication code.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
- },
- {
- "action": "user.unblock_user",
- "description": "A user was unblocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unminimize_comment",
- "description": "A comment made by a user was unminimized.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unsuspend",
- "description": "A user account was unsuspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_integration_secret",
- "description": "A user secret for Codespaces was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_new_repository_default_branch_setting",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.cancel_workflow_run",
- "description": "A workflow run was cancelled.",
- "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.completed_workflow_run",
- "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history"
- },
- {
- "action": "workflows.created_workflow_run",
- "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.prepared_workflow_job",
- "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.rerun_workflow_run",
- "description": "A workflow run was re-run.",
- "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.9/organization.json b/src/audit-logs/data/ghes-3.9/organization.json
deleted file mode 100644
index af5ee3521633..000000000000
--- a/src/audit-logs/data/ghes-3.9/organization.json
+++ /dev/null
@@ -1,2817 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.accept",
- "description": "Credit was accepted for a security advisory.",
- "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory"
- },
- {
- "action": "advisory_credit.create",
- "description": "Someone was added to the credit section of a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.decline",
- "description": "Credit was declined for a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "advisory_credit.destroy",
- "description": "Someone was removed from the credit section of a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "auto_approve_personal_access_token_requests.disable",
- "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
- },
- {
- "action": "auto_approve_personal_access_token_requests.enable",
- "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.attempted_to_create_from_prebuild",
- "description": "An attempt to create a codespace from a prebuild was made.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.business_enablement_updated",
- "description": "Enterprise setting for Codespaces ownership was updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_created",
- "description": "Policies were applied to codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_deleted",
- "description": "Policies were removed from codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.policy_group_updated",
- "description": "Policies were updated for codespaces in an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "commit_comment.destroy",
- "description": "A commit comment was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "commit_comment.update",
- "description": "A commit comment was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_comment.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_comment.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "discussion_post.destroy",
- "description": "Triggered when a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.destroy",
- "description": "Triggered when a reply to a team discussion post is deleted.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment"
- },
- {
- "action": "discussion_post_reply.update",
- "description": "Triggered when a reply to a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "discussion_post.update",
- "description": "Triggered when a team discussion post is edited.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment"
- },
- {
- "action": "enterprise_installation.create",
- "description": "The GitHub App associated with a GitHub Connect connection was created.",
- "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect"
- },
- {
- "action": "enterprise_installation.destroy",
- "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
- "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "git.clone",
- "description": "A repository was cloned.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.fetch",
- "description": "Changes were fetched from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "git.push",
- "description": "Changes were pushed to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation_request.close",
- "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
- "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
- },
- {
- "action": "integration_installation_request.create",
- "description": "A member requested that an owner install a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "ip_allow_list.disable",
- "description": "An IP allow list was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.disable_for_installed_apps",
- "description": "An IP allow list was disabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable",
- "description": "An IP allow list was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list.enable_for_installed_apps",
- "description": "An IP allow list was enabled for installed GitHub Apps.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.create",
- "description": "An IP address was added to an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.destroy",
- "description": "An IP address was deleted from an IP allow list.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ip_allow_list_entry.update",
- "description": "An IP address or its description was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue_comment.destroy",
- "description": "A comment on an issue was deleted from the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue_comment.update",
- "description": "A comment on an issue (other than the initial one) changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "issue.destroy",
- "description": "An issue was deleted from the repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue"
- },
- {
- "action": "issue.pinned",
- "description": "An issue was pinned to a repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository"
- },
- {
- "action": "issue.transfer",
- "description": "An issue was transferred to another repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository"
- },
- {
- "action": "issue.unpinned",
- "description": "An issue was unpinned from a repository.",
- "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository"
- },
- {
- "action": "issues.deletes_disabled",
- "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "issues.deletes_enabled",
- "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "issues.deletes_policy_cleared",
- "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "members_can_create_pages.disable",
- "description": "The ability for members to publish GitHub Pages sites was disabled.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_pages.enable",
- "description": "The ability for members to publish GitHub Pages sites was enabled.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_private_pages.disable",
- "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_private_pages.enable",
- "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_public_pages.disable",
- "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_create_public_pages.enable",
- "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
- },
- {
- "action": "members_can_delete_repos.clear",
- "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_delete_repos.disable",
- "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_delete_repos.enable",
- "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer"
- },
- {
- "action": "members_can_view_dependency_insights.clear",
- "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "members_can_view_dependency_insights.disable",
- "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise"
- },
- {
- "action": "members_can_view_dependency_insights.enable",
- "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.destroy_file",
- "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.download",
- "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "org.accept_business_invitation",
- "description": "An invitation sent to an organization to join an enterprise was accepted.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.add_billing_manager",
- "description": "A billing manager was added to an organization.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_policy_selected_member_disabled",
- "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.advanced_security_policy_selected_member_enabled",
- "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise"
- },
- {
- "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled",
- "description": "Third-party application access for outside collaborators was disabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
- },
- {
- "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled",
- "description": "Third-party application access for outside collaborators was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests"
- },
- {
- "action": "org.archive",
- "description": "The organization was archived.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.audit_log_export",
- "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
- },
- {
- "action": "org.audit_log_git_event_export",
- "description": "An export of the organization's Git events was created.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
- },
- {
- "action": "org.billing_signup_error",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.block_user",
- "description": "An organization owner blocked a user from accessing the organization's repositories.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
- },
- {
- "action": "org.cancel_business_invitation",
- "description": "An invitation for an organization to join an enterprise was revoked",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.cancel_invitation",
- "description": "An invitation sent to a user to join an organization was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.clear_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for an organization.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale"
- },
- {
- "action": "org.codespaces_trusted_repo_access_granted",
- "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "org.codespaces_trusted_repo_access_revoked",
- "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "org.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only for an organization was enabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
- },
- {
- "action": "org.confirm_business_invitation",
- "description": "An invitation for an organization to join an enterprise was confirmed.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account"
- },
- {
- "action": "org.connect_usage_metrics_export",
- "description": "Server statistics were exported for the organization.",
- "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics"
- },
- {
- "action": "org.create",
- "description": "An organization was created.",
- "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
- },
- {
- "action": "org.create_actions_secret",
- "description": "A GitHub Actions secret was created for an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.create_actions_variable",
- "description": "A GitHub Actions variable was created for an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org_credential_authorization.deauthorize",
- "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
- "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on"
- },
- {
- "action": "org_credential_authorization.grant",
- "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
- "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on"
- },
- {
- "action": "org_credential_authorization.revoke",
- "description": "An owner revoked authorized credentials.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization"
- },
- {
- "action": "org.disable_member_team_creation_permission",
- "description": "Team creation was limited to owners.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.disable_oauth_app_restrictions",
- "description": "Third-party application access restrictions for an organization were disabled.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
- },
- {
- "action": "org.disable_reader_discussion_creation_permission",
- "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.disable_saml",
- "description": "SAML single sign-on was disabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.disable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the organization was disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
- },
- {
- "action": "org.disable_two_factor_requirement",
- "description": "A two-factor authentication requirement was disabled for the organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_disabled",
- "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.display_commenter_full_name_enabled",
- "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.enable_member_team_creation_permission",
- "description": "Team creation by members was allowed.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
- },
- {
- "action": "org.enable_oauth_app_restrictions",
- "description": "Third-party application access restrictions for an organization were enabled.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
- },
- {
- "action": "org.enable_reader_discussion_creation_permission",
- "description": "An organization owner allowed users with read access to create discussions in an organization",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
- },
- {
- "action": "org.enable_saml",
- "description": "SAML single sign-on was enabled for the organization.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization"
- },
- {
- "action": "org.enable_source_ip_disclosure",
- "description": "Display of IP addresses within audit log events for the organization was enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
- },
- {
- "action": "org.enable_two_factor_requirement",
- "description": "Two-factor authentication is now required for the organization.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.integration_manager_added",
- "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.integration_manager_removed",
- "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.invite_member",
- "description": "A new user was invited to join an organization.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
- },
- {
- "action": "org.invite_to_business",
- "description": "An organization was invited to join an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.disable",
- "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.members_can_update_protected_branches.enable",
- "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.oauth_app_access_approved",
- "description": "Access to an organization was granted for an OAuth App.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
- },
- {
- "action": "org.oauth_app_access_denied",
- "description": "Access was disabled for an OAuth App that was previously approved.",
- "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
- },
- {
- "action": "org.oauth_app_access_requested",
- "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.rate_limited_invites",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization"
- },
- {
- "action": "org.remove_actions_secret",
- "description": "A GitHub Actions secret was removed from an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.remove_actions_variable",
- "description": "A GitHub Actions variable was removed from an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.remove_billing_manager",
- "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
- },
- {
- "action": "org.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was removed from an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_outside_collaborator",
- "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_security_manager",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization"
- },
- {
- "action": "org.rename",
- "description": "An organization was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.required_workflow_create",
- "description": "Triggered when a required workflow is created.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.required_workflow_delete",
- "description": "Triggered when a required workflow is deleted.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.required_workflow_update",
- "description": "Triggered when a required workflow is updated.",
- "docs_reference_links": "/actions/using-workflows/required-workflows"
- },
- {
- "action": "org.restore_member",
- "description": "An organization member was restored.",
- "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
- },
- {
- "action": "org.revoke_external_identity",
- "description": "A member's linked identity was revoked.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity"
- },
- {
- "action": "org.revoke_sso_session",
- "description": "A member's SAML session was revoked.",
- "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity"
- },
- {
- "action": "org.runner_group_created",
- "description": "A self-hosted runner group was created.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org.runner_group_removed",
- "description": "A self-hosted runner group was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_renamed",
- "description": "A self-hosted runner group was renamed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_runner_removed",
- "description": "The REST API was used to remove a self-hosted runner from a group.",
- "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_runners_added",
- "description": "A self-hosted runner was added to a group.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group"
- },
- {
- "action": "org.runner_group_runners_updated",
- "description": "A runner group's list of members was updated.",
- "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
- },
- {
- "action": "org.runner_group_updated",
- "description": "The configuration of a self-hosted runner group was changed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group"
- },
- {
- "action": "org.runner_group_visiblity_updated",
- "description": "The visibility of a self-hosted runner group was updated via the REST API.",
- "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org.secret_scanning_custom_pattern_push_protection_enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization"
- },
- {
- "action": "org_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_disabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_enabled",
- "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_custom_message_updated",
- "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization"
- },
- {
- "action": "org.secret_scanning_push_protection_disable",
- "description": "Push protection for secret scanning was disabled.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "org.secret_scanning_push_protection_enable",
- "description": "Push protection for secret scanning was enabled.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_disable",
- "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.secret_scanning_push_protection_new_repos_enable",
- "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
- "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations"
- },
- {
- "action": "org.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "org.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_custom_invitation_rate_limit",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.sso_response",
- "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.transfer",
- "description": "An organization was transferred between enterprise accounts.",
- "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts"
- },
- {
- "action": "org.transfer_outgoing",
- "description": "An organization was transferred between enterprise accounts.",
- "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts"
- },
- {
- "action": "org.unblock_user",
- "description": "A user was unblocked from an organization.",
- "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
- },
- {
- "action": "org.update_actions_secret",
- "description": "A GitHub Actions secret was updated for an organization.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization"
- },
- {
- "action": "org.update_actions_settings",
- "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
- },
- {
- "action": "org.update_actions_variable",
- "description": "A GitHub Actions variable was updated for an organization.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization"
- },
- {
- "action": "org.update_default_repository_permission",
- "description": "The default repository permission level for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "org.update_new_repository_default_branch_setting",
- "description": "The name of the default branch was changed for new repositories in the organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
- },
- {
- "action": "org.update_saml_provider_settings",
- "description": "An organization's SAML provider settings were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_terms_of_service",
- "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
- "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
- },
- {
- "action": "organization_default_label.create",
- "description": "A default label was created for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
- },
- {
- "action": "organization_default_label.destroy",
- "description": "A default label was deleted for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
- },
- {
- "action": "organization_default_label.update",
- "description": "A default label was edited for repositories in an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
- },
- {
- "action": "organization_domain.approve",
- "description": "A domain was approved for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.create",
- "description": "A domain was added to an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_domain.destroy",
- "description": "A domain was removed from an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain"
- },
- {
- "action": "organization_domain.verify",
- "description": "A domain was verified for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
- },
- {
- "action": "organization_moderators.add_team",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.add_user",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.remove_team",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_moderators.remove_user",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "organization_projects_change.clear",
- "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "organization_projects_change.disable",
- "description": "Organization projects were disabled for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "organization_projects_change.enable",
- "description": "Organization projects were enabled for all organizations in an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards"
- },
- {
- "action": "packages.package_deleted",
- "description": "An entire package was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_published",
- "description": "A package was published or republished to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "packages.package_version_deleted",
- "description": "A specific package version was deleted.",
- "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package"
- },
- {
- "action": "packages.package_version_published",
- "description": "A specific package version was published or republished to a package.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "prebuild_configuration.create",
- "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.destroy",
- "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.run_triggered",
- "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "prebuild_configuration.update",
- "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
- "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.clear",
- "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.disable",
- "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_repository_forking.enable",
- "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.authorized_users_teams",
- "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
- },
- {
- "action": "protected_branch.create",
- "description": "Branch protection was enabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.destroy",
- "description": "Branch protection was disabled on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismiss_stale_reviews",
- "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.dismissal_restricted_users_teams",
- "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.policy_override",
- "description": "A branch protection requirement was overridden by a repository administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.rejected_ref_update",
- "description": "A branch update attempt was rejected.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_admin_enforced",
- "description": "Branch protection was enforced for repository administrators.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_deletions_enforcement_level",
- "description": "Branch deletion was enabled or disabled for a protected branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_allow_force_pushes_enforcement_level",
- "description": "Force pushes were enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_ignore_approvals_from_contributors",
- "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
- },
- {
- "action": "protected_branch.update_linear_history_requirement_enforcement_level",
- "description": "Required linear commit history was enabled or disabled for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_lock_allows_fetch_and_merge",
- "description": "Fork syncing was enabled or disabled for a read-only branch",
- "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_lock_branch_enforcement_level",
- "description": "The enforcement of a branch lock was updated.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "protected_branch.update_name",
- "description": "A branch name pattern was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_pull_request_reviews_enforcement_level",
- "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_code_owner_review",
- "description": "Enforcement of required code owner review was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_require_last_push_approval",
- "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
- },
- {
- "action": "protected_branch.update_required_approving_review_count",
- "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_required_status_checks_enforcement_level",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_signature_requirement_enforcement_level",
- "description": "Enforcement of required commit signing was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "protected_branch.update_strict_required_status_checks_policy",
- "description": "Enforcement of required status checks was updated for a branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "pull_request.close",
- "description": "A pull request was closed without being merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
- },
- {
- "action": "pull_request.converted_to_draft",
- "description": "A pull request was converted to a draft.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
- },
- {
- "action": "pull_request.create",
- "description": "A pull request was created.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request"
- },
- {
- "action": "pull_request.create_review_request",
- "description": "A review was requested on a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.in_progress",
- "description": "A pull request was marked as in progress.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.indirect_merge",
- "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.merge",
- "description": "A pull request was merged.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
- },
- {
- "action": "pull_request.ready_for_review",
- "description": "A pull request was marked as ready for review.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
- },
- {
- "action": "pull_request.rebase",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request.remove_review_request",
- "description": "A review request was removed from a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request.reopen",
- "description": "A pull request was reopened after previously being closed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.create",
- "description": "A review comment was added to a pull request.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
- },
- {
- "action": "pull_request_review_comment.delete",
- "description": "A review comment on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review_comment.update",
- "description": "A review comment on a pull request was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.delete",
- "description": "A review on a pull request was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "pull_request_review.dismiss",
- "description": "A review on a pull request was dismissed.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
- },
- {
- "action": "pull_request_review.submit",
- "description": "A review on a pull request was submitted.",
- "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.codeql_disabled",
- "description": "Code scanning using the default setup was disabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codeql_enabled",
- "description": "Code scanning using the default setup was enabled for a repository.",
- "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"
- },
- {
- "action": "repo.codespaces_trusted_repo_access_granted",
- "description": "GitHub Codespaces was granted trusted repository access to this repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.codespaces_trusted_repo_access_revoked",
- "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.download_zip",
- "description": "A source code archive of a repository was downloaded as a ZIP file.",
- "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.rename_branch",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.self_hosted_runner_offline",
- "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_online",
- "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner"
- },
- {
- "action": "repo.self_hosted_runner_updated",
- "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.close",
- "description": "Someone closed a security advisory.",
- "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories"
- },
- {
- "action": "repository_advisory.cve_request",
- "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.github_broadcast",
- "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.github_withdraw",
- "description": "GitHub withdrew a security advisory that was published in error.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.open",
- "description": "Someone opened a draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.publish",
- "description": "Someone published a security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.reopen",
- "description": "Someone reopened as draft security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_advisory.update",
- "description": "Someone edited a draft or published security advisory.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_content_analysis.disable",
- "description": "Data use settings were disabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_content_analysis.enable",
- "description": "Data use settings were enabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_dependency_graph.disable",
- "description": "The dependency graph was disabled for a private repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
- },
- {
- "action": "repository_dependency_graph.enable",
- "description": "The dependency graph was enabled for a private repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_projects_change.clear",
- "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise"
- },
- {
- "action": "repository_projects_change.disable",
- "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_projects_change.enable",
- "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.create",
- "description": "A custom pattern was created for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.delete",
- "description": "A custom pattern was removed from secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.disabled",
- "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern_push_protection.enabled",
- "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository"
- },
- {
- "action": "repository_secret_scanning_custom_pattern.update",
- "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
- "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern"
- },
- {
- "action": "repository_secret_scanning.disable",
- "description": "Secret scanning was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "repository_secret_scanning.enable",
- "description": "Secret scanning was enabled for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_secret_scanning_push_protection.disable",
- "description": "Secret scanning push protection was disabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_secret_scanning_push_protection.enable",
- "description": "Secret scanning push protection was enabled for a repository.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning"
- },
- {
- "action": "repository_visibility_change.clear",
- "description": "The repository visibility change setting was cleared for an organization or enterprise.",
- "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility"
- },
- {
- "action": "repository_visibility_change.disable",
- "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_visibility_change.enable",
- "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.create",
- "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
- "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
- },
- {
- "action": "repository_vulnerability_alert.dismiss",
- "description": "A Dependabot alert was manually dismissed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.reintroduce",
- "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.reopen",
- "description": "A Dependabot alert was manually reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alert.resolve",
- "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.authorized_users_teams",
- "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
- },
- {
- "action": "repository_vulnerability_alerts.disable",
- "description": "Dependabot alerts was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_vulnerability_alerts.enable",
- "description": "Dependabot alerts was enabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "required_status_check.create",
- "description": "A status check was marked as required for a protected branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
- },
- {
- "action": "required_status_check.destroy",
- "description": "A status check was no longer marked as required for a protected branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
- },
- {
- "action": "restrict_notification_delivery.disable",
- "description": "Email notification restrictions for an organization or enterprise were disabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "restrict_notification_delivery.enable",
- "description": "Email notification restrictions for an organization or enterprise were enabled.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise"
- },
- {
- "action": "role.create",
- "description": "A new custom repository role was created.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "role.destroy",
- "description": "A custom repository role was deleted.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "role.update",
- "description": "A custom repository role was edited.",
- "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization"
- },
- {
- "action": "secret_scanning_alert.create",
- "description": "GitHub detected a secret and created a secret scanning alert.",
- "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
- },
- {
- "action": "secret_scanning_alert.reopen",
- "description": "A secret scanning alert was reopened.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.resolve",
- "description": "A secret scanning alert was resolved.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning_alert.revoke",
- "description": "A secret scanning alert was revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "secret_scanning.disable",
- "description": "Secret scanning was disabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning.enable",
- "description": "Secret scanning was enabled for all existing repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.disable",
- "description": "Secret scanning was disabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_new_repos.enable",
- "description": "Secret scanning was enabled for all new repositories.",
- "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning"
- },
- {
- "action": "secret_scanning_push_protection.bypass",
- "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
- "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "ssh_certificate_authority.create",
- "description": "An SSH certificate authority for an organization or enterprise was created.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_authority.destroy",
- "description": "An SSH certificate authority for an organization or enterprise was deleted.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.disable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "ssh_certificate_requirement.enable",
- "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
- "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise"
- },
- {
- "action": "staff.dependabot_debug_credentials_generated",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.set_domain_token_expiration",
- "description": "The verification code expiry time for an organization or enterprise domain was set.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.unverify_domain",
- "description": "An organization or enterprise domain was unverified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "staff.verify_domain",
- "description": "An organization or enterprise domain was verified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.add_member",
- "description": "A member of an organization was added to a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
- },
- {
- "action": "team.add_repository",
- "description": "A team was given access and permissions to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.change_parent_team",
- "description": "A child team was created or a child team's parent was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
- },
- {
- "action": "team.change_privacy",
- "description": "A team's privacy level was changed.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility"
- },
- {
- "action": "team.create",
- "description": "A new team is created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.demote_maintainer",
- "description": "A user was demoted from a team maintainer to a team member.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
- },
- {
- "action": "team.destroy",
- "description": "A team was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.clear",
- "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_discussions.disable",
- "description": "Team discussions were disabled for an organization.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization"
- },
- {
- "action": "team_discussions.enable",
- "description": "Team discussions were enabled for an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_group_mapping.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.promote_maintainer",
- "description": "A user was promoted from a team member to a team maintainer.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
- },
- {
- "action": "team.remove_member",
- "description": "An organization member was removed from a team.",
- "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
- },
- {
- "action": "team.remove_repository",
- "description": "A repository was removed from a team's control.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.rename",
- "description": "A team's name was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team_sync_tenant.disabled",
- "description": "Team synchronization with a tenant was disabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.enabled",
- "description": "Team synchronization with a tenant was enabled.",
- "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise"
- },
- {
- "action": "team_sync_tenant.update_okta_credentials",
- "description": "The Okta credentials for team synchronization with a tenant were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "team.update_repository_permission",
- "description": "A team's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.cancel_workflow_run",
- "description": "A workflow run was cancelled.",
- "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.completed_workflow_run",
- "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history"
- },
- {
- "action": "workflows.created_workflow_run",
- "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.prepared_workflow_job",
- "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
- "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.rerun_workflow_run",
- "description": "A workflow run was re-run.",
- "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.9/user.json b/src/audit-logs/data/ghes-3.9/user.json
deleted file mode 100644
index 1aaaf8d66949..000000000000
--- a/src/audit-logs/data/ghes-3.9/user.json
+++ /dev/null
@@ -1,1737 +0,0 @@
-[
- {
- "action": "account.billing_date_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account.plan_change",
- "description": "The account's plan changed.",
- "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans"
- },
- {
- "action": "account_recovery_token.confirm",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "account_recovery_token.recover",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "actions_cache.delete",
- "description": "A GitHub Actions cache was deleted using the REST API.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "artifact.destroy",
- "description": "A workflow run artifact was manually deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.change_billing_type",
- "description": "The way the account pays for GitHub was changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method"
- },
- {
- "action": "billing.change_email",
- "description": "The billing email address changed.",
- "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email"
- },
- {
- "action": "billing.lock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "billing.update_bill_cycle_day",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "business.set_actions_fork_pr_approvals_policy",
- "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories"
- },
- {
- "action": "business.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise"
- },
- {
- "action": "business.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise"
- },
- {
- "action": "business.set_fork_pr_workflows_policy",
- "description": "The policy for fork pull request workflows was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise"
- },
- {
- "action": "business.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
- "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "checks.auto_trigger_disabled",
- "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.auto_trigger_enabled",
- "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
- "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites"
- },
- {
- "action": "checks.delete_logs",
- "description": "Logs in a check suite were deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.allow_permissions",
- "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.connect",
- "description": "Credentials for a codespace were refreshed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.create",
- "description": "A codespace was created",
- "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository"
- },
- {
- "action": "codespaces.destroy",
- "description": "A user deleted a codespace.",
- "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace"
- },
- {
- "action": "codespaces.export_environment",
- "description": "A codespace was exported to a branch on GitHub.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.restore",
- "description": "A codespace was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.suspend_environment",
- "description": "A codespace was stopped.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "codespaces.trusted_repositories_access_update",
- "description": "A personal account's access and security setting for Codespaces were updated.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "custom_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "custom_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_alerts.disable",
- "description": "Dependabot alerts were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts.enable",
- "description": "Dependabot alerts were enabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
- },
- {
- "action": "dependabot_alerts_new_repos.disable",
- "description": "Dependabot alerts were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_alerts_new_repos.enable",
- "description": "Dependabot alerts were enabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
- },
- {
- "action": "dependabot_repository_access.repositories_updated",
- "description": "The repositories that Dependabot can access were updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates.disable",
- "description": "Dependabot security updates were disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates.enable",
- "description": "Dependabot security updates were enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependabot_security_updates_new_repos.disable",
- "description": " Dependabot security updates were disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependabot_security_updates_new_repos.enable",
- "description": "Dependabot security updates were enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph.disable",
- "description": "The dependency graph was disabled for all existing repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph.enable",
- "description": "The dependency graph was enabled for all existing repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "dependency_graph_new_repos.disable",
- "description": "The dependency graph was disabled for all new repositories.",
- "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
- },
- {
- "action": "dependency_graph_new_repos.enable",
- "description": "The dependency graph was enabled for all new repositories.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.add_protection_rule",
- "description": "A GitHub Actions deployment protection rule was created via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "environment.create_actions_secret",
- "description": "A secret was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.create_actions_variable",
- "description": "A variable was created for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.delete",
- "description": "An environment was deleted.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment"
- },
- {
- "action": "environment.remove_actions_secret",
- "description": "A secret was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.remove_actions_variable",
- "description": "A variable was deleted for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.remove_protection_rule",
- "description": "A GitHub Actions deployment protection rule was deleted via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "environment.update_actions_secret",
- "description": "A secret was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets"
- },
- {
- "action": "environment.update_actions_variable",
- "description": "A variable was updated for a GitHub Actions environment.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment"
- },
- {
- "action": "environment.update_protection_rule",
- "description": "A GitHub Actions deployment protection rule was updated via the API.",
- "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules"
- },
- {
- "action": "git_signing_ssh_public_key.create",
- "description": "An SSH key was added to a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "git_signing_ssh_public_key.delete",
- "description": "An SSH key was removed from a user account as a Git commit signing key.",
- "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
- },
- {
- "action": "github_hosted_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "github_hosted_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "gpg_key.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.active_changed",
- "description": "A hook's active status was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.config_changed",
- "description": "A hook's configuration was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.create",
- "description": "A new hook was added.",
- "docs_reference_links": "/get-started/exploring-integrations/about-webhooks"
- },
- {
- "action": "hook.destroy",
- "description": "A hook was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "hook.events_changed",
- "description": "A hook's configured events were changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.create",
- "description": "A GitHub App was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.destroy",
- "description": "A GitHub App was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.generate_client_secret",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration_installation.create",
- "description": "A GitHub App was installed.",
- "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps"
- },
- {
- "action": "integration_installation.destroy",
- "description": "A GitHub App was uninstalled.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.repositories_added",
- "description": "Repositories were added to a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.repositories_removed",
- "description": "Repositories were removed from a GitHub App.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
- },
- {
- "action": "integration_installation.suspend",
- "description": "A GitHub App was suspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.unsuspend",
- "description": "A GitHub App was unsuspended.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
- },
- {
- "action": "integration_installation.version_updated",
- "description": "Permissions for a GitHub App were updated.",
- "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
- },
- {
- "action": "integration.manager_added",
- "description": "A member of an enterprise or organization was added as a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
- },
- {
- "action": "integration.manager_removed",
- "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
- },
- {
- "action": "integration.remove_client_secret",
- "description": "A client secret for a GitHub App was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_all_tokens",
- "description": "All user tokens for a GitHub App were requested to be revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.revoke_tokens",
- "description": "Token(s) for a GitHub App were revoked.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "integration.transfer",
- "description": "Ownership of a GitHub App was transferred to another user or organization.",
- "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
- },
- {
- "action": "marketplace_agreement_signature.create",
- "description": "The GitHub Marketplace Developer Agreement was signed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.approve",
- "description": "A listing was approved for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.change_category",
- "description": "A category for a listing for an app in GitHub Marketplace was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.create",
- "description": "A listing for an app in GitHub Marketplace was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.delist",
- "description": "A listing was removed from GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.publish",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.retire",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing_plan.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.redraft",
- "description": "A listing was sent back to draft state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "marketplace_listing.reject",
- "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_dequeued",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.pull_request_queue_jump",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.queue_cleared",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "merge_queue.update_settings",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "metered_billing_configuration.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "migration.create",
- "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "oauth_application.create",
- "description": "An OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.destroy",
- "description": "An OAuth application was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.generate_client_secret",
- "description": "An OAuth application's secret key was generated.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.remove_client_secret",
- "description": "An OAuth application's secret key was deleted.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.reset_secret",
- "description": "The secret key for an OAuth application was reset.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_all_tokens",
- "description": "All user tokens for an OAuth application were requested to be revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.revoke_tokens",
- "description": "Token(s) for an OAuth application were revoked.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_application.transfer",
- "description": "An OAuth application was transferred from one account to another.",
- "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
- },
- {
- "action": "oauth_authorization.create",
- "description": "An authorization for an OAuth application was created.",
- "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
- },
- {
- "action": "oauth_authorization.destroy",
- "description": "An authorization for an OAuth application was deleted.",
- "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations"
- },
- {
- "action": "org.add_member",
- "description": "A user joined an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.add_outside_collaborator",
- "description": "An outside collaborator was added to a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_for_new_repos",
- "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_disabled_on_all_repos",
- "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_for_new_repos",
- "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.advanced_security_enabled_on_all_repos",
- "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.remove_member",
- "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
- },
- {
- "action": "org.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
- },
- {
- "action": "org.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
- },
- {
- "action": "org.set_fork_pr_workflows_policy",
- "description": "The policy for workflows on private repository forks was changed.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "org.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
- "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "org.update_member",
- "description": "A person's role was changed from owner to member or member to owner.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_creation_permission",
- "description": "The create repository permission for organization members was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "org.update_member_repository_invitation_permission",
- "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
- "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators"
- },
- {
- "action": "pages_protected_domain.create",
- "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.delete",
- "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "pages_protected_domain.verify",
- "description": "A GitHub Pages domain was verified for an organization or enterprise.",
- "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
- },
- {
- "action": "passkey.register",
- "description": "A new passkey was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "passkey.remove",
- "description": "A new passkey was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.create",
- "description": "A new payment method was added, such as a new credit card or PayPal account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.remove",
- "description": "A payment method was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "payment_method.update",
- "description": "An existing payment method was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.access_granted",
- "description": "A fine-grained personal access token was granted access to resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.access_revoked",
- "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.create",
- "description": "Triggered when you create a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_regenerated",
- "description": "Triggered when you regenerate a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.credential_revoked",
- "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
- "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users"
- },
- {
- "action": "personal_access_token.destroy",
- "description": "Triggered when you delete a fine-grained personal access token.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_cancelled",
- "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "personal_access_token.request_created",
- "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.request_denied",
- "description": "A request for a fine-grained personal access token to access organization resources was denied.",
- "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
- },
- {
- "action": "personal_access_token.update",
- "description": "A fine-grained personal access token was updated.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens"
- },
- {
- "action": "premium_runner.create",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "premium_runner.update",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.disable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "private_vulnerability_reporting_new_repos.enable",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "profile_picture.update",
- "description": "A profile picture was updated.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile"
- },
- {
- "action": "project.access",
- "description": "A project board visibility was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.close",
- "description": "A project board was closed.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board"
- },
- {
- "action": "project.create",
- "description": "A project board was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.delete",
- "description": "A project board was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_field.create",
- "description": "A field was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields"
- },
- {
- "action": "project_field.delete",
- "description": "A field was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
- },
- {
- "action": "project.link",
- "description": "A repository was linked to a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.open",
- "description": "A project board was reopened.",
- "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board"
- },
- {
- "action": "project.rename",
- "description": "A project board was renamed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.unlink",
- "description": "A repository was unlinked from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_org_permission",
- "description": "The project's base-level permission for all organization members was changed or removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_team_permission",
- "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project.update_user_permission",
- "description": "A user was added to or removed from a project board or had their permission level changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "project_view.create",
- "description": "A view was created in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "project_view.delete",
- "description": "A view was deleted in a project board.",
- "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
- },
- {
- "action": "protected_branch.update_merge_queue_enforcement_level",
- "description": "Enforcement of the merge queue was modified for a branch.",
- "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
- },
- {
- "action": "public_key.create",
- "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
- },
- {
- "action": "public_key.delete",
- "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
- },
- {
- "action": "public_key.unverification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.unverify",
- "description": "A user account's SSH key or a repository's deploy key was unverified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.update",
- "description": "A user account's SSH key or a repository's deploy key was updated.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verification_failure",
- "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "public_key.verify",
- "description": "A user account's SSH key or a repository's deploy key was verified.",
- "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
- },
- {
- "action": "repo.access",
- "description": "The visibility of a repository changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
- },
- {
- "action": "repo.actions_enabled",
- "description": "GitHub Actions was enabled for a repository.",
- "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
- },
- {
- "action": "repo.add_member",
- "description": "A collaborator was added to a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository"
- },
- {
- "action": "repo.add_topic",
- "description": "A topic was added to a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
- },
- {
- "action": "repo.advanced_security_disabled",
- "description": "GitHub Advanced Security was disabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.advanced_security_enabled",
- "description": "GitHub Advanced Security was enabled for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
- },
- {
- "action": "repo.archived",
- "description": "A repository was archived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.change_merge_setting",
- "description": "Pull request merge options were changed for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.code_scanning_analysis_deleted",
- "description": "Code scanning analysis for a repository was deleted.",
- "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
- },
- {
- "action": "repo.code_scanning_configuration_for_branch_deleted",
- "description": "A code scanning configuration for a branch of a repository was deleted.",
- "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
- },
- {
- "action": "repo.config.disable_collaborators_only",
- "description": "The interaction limit for collaborators only was disabled.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_contributors_only",
- "description": "The interaction limit for prior contributors only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.disable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users only was disabled in a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_collaborators_only",
- "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_contributors_only",
- "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.config.enable_sockpuppet_disallowed",
- "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
- "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
- },
- {
- "action": "repo.create",
- "description": "A repository was created.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
- },
- {
- "action": "repo.create_actions_secret",
- "description": "A GitHub Actions secret was created for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.create_actions_variable",
- "description": "A GitHub Actions variable was created for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.create_integration_secret",
- "description": "A Codespaces or Dependabot secret was created for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.destroy",
- "description": "A repository was deleted.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository"
- },
- {
- "action": "repo.pages_cname",
- "description": "A GitHub Pages custom domain was modified in a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_create",
- "description": "A GitHub Pages site was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_destroy",
- "description": "A GitHub Pages site was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_disabled",
- "description": "HTTPS redirects were disabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_https_redirect_enabled",
- "description": "HTTPS redirects were enabled for a GitHub Pages site.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_private",
- "description": "A GitHub Pages site visibility was changed to private.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_public",
- "description": "A GitHub Pages site visibility was changed to public.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.pages_source",
- "description": "A GitHub Pages source was modified.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.register_self_hosted_runner",
- "description": "A new self-hosted runner was registered.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository"
- },
- {
- "action": "repo.remove_actions_secret",
- "description": "A GitHub Actions secret was deleted for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.remove_actions_variable",
- "description": "A GitHub Actions variable was deleted for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.remove_integration_secret",
- "description": "A Codespaces or Dependabot secret was deleted for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.remove_member",
- "description": "A collaborator was removed from a repository.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository"
- },
- {
- "action": "repo.remove_self_hosted_runner",
- "description": "A self-hosted runner was removed.",
- "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository"
- },
- {
- "action": "repo.remove_topic",
- "description": "A topic was removed from a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.rename",
- "description": "A repository was renamed.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository"
- },
- {
- "action": "repo.restore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.set_actions_fork_pr_approvals_policy",
- "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
- },
- {
- "action": "repo.set_actions_private_fork_pr_approvals_policy",
- "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
- },
- {
- "action": "repo.set_actions_retention_limit",
- "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
- },
- {
- "action": "repo.set_default_workflow_permissions",
- "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
- },
- {
- "action": "repo.set_fork_pr_workflows_policy",
- "description": "Triggered when the policy for workflows on private repository forks is changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
- },
- {
- "action": "repo.set_workflow_permission_can_approve_pr",
- "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
- },
- {
- "action": "repo.staff_unlock",
- "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer",
- "description": "A user accepted a request to receive a transferred repository.",
- "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository"
- },
- {
- "action": "repo.transfer_outgoing",
- "description": "A repository was transferred to another repository network.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.transfer_start",
- "description": "A user sent a request to transfer a repository to another user or organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.unarchived",
- "description": "A repository was unarchived.",
- "docs_reference_links": "/repositories/archiving-a-github-repository"
- },
- {
- "action": "repo.unlock",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_access_settings",
- "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_secret",
- "description": "A GitHub Actions secret was updated for a repository.",
- "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository"
- },
- {
- "action": "repo.update_actions_settings",
- "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_actions_variable",
- "description": "A GitHub Actions variable was updated for a repository.",
- "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository"
- },
- {
- "action": "repo.update_default_branch",
- "description": "The default branch for a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_integration_secret",
- "description": "A Codespaces or Dependabot secret was updated for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repo.update_member",
- "description": "A user's permission to a repository was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.create",
- "description": "An image to represent a repository was uploaded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_image.destroy",
- "description": "An image to represent a repository was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.accept",
- "description": "An invitation to join a repository was accepted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.cancel",
- "description": "An invitation to join a repository was canceled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.create",
- "description": "An invitation to join a repository was sent.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "repository_invitation.reject",
- "description": "An invitation to join a repository was declined.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "security_key.register",
- "description": "A security key was registered for an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "security_key.remove",
- "description": "A security key was removed from an account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.agreement_sign",
- "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.custom_amount_settings_change",
- "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.fiscal_host_change",
- "description": "The fiscal host for a GitHub Sponsors listing was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.repo_funding_links_file_action",
- "description": "The FUNDING file in a repository was changed.",
- "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
- },
- {
- "action": "sponsors.sponsor_sponsorship_cancel",
- "description": "A sponsorship was canceled.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_create",
- "description": "A sponsorship was created, by sponsoring an account.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_payment_complete",
- "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
- },
- {
- "action": "sponsors.sponsor_sponsorship_preference_change",
- "description": "The option to receive email updates from a sponsored account was changed.",
- "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
- },
- {
- "action": "sponsors.sponsor_sponsorship_tier_change",
- "description": "A sponsorship was upgraded or downgraded.",
- "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship"
- },
- {
- "action": "sponsors.sponsored_developer_approve",
- "description": "A GitHub Sponsors account was approved.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_create",
- "description": "A GitHub Sponsors account was created.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_disable",
- "description": "A GitHub Sponsors account was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_profile_update",
- "description": "The profile for GitHub Sponsors account was edited.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
- },
- {
- "action": "sponsors.sponsored_developer_redraft",
- "description": "A GitHub Sponsors account was returned to draft state from approved state.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.sponsored_developer_request_approval",
- "description": "An application for GitHub Sponsors was submitted for approval.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.sponsored_developer_tier_description_update",
- "description": "The description for a sponsorship tier was changed.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
- },
- {
- "action": "sponsors.sponsored_developer_update_newsletter_send",
- "description": "Triggered when you send an email update to your sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
- },
- {
- "action": "sponsors.update_tier_repository",
- "description": "A GitHub Sponsors tier changed access for a repository.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.update_tier_welcome_message",
- "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "sponsors.waitlist_join",
- "description": "You join the waitlist to join GitHub Sponsors.",
- "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
- },
- {
- "action": "sponsors.withdraw_agreement_signature",
- "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.accept",
- "description": "Triggered when you accept a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.cancel",
- "description": "Triggered when you cancel a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.create",
- "description": "Triggered when you create a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.decline",
- "description": "Triggered when you decline a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "successor_invitation.destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "successor_invitation.revoke",
- "description": "Triggered when you revoke a succession invitation.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories"
- },
- {
- "action": "trusted_device.register",
- "description": "A new trusted device was added.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "trusted_device.remove",
- "description": "A trusted device was removed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.abort",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.complete",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.ignore",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_approve",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.staff_decline",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.start",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_account_recovery.two_factor_destroy",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.add_factor",
- "description": "A secondary authentication factor was added to a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.disabled",
- "description": "Two-factor authentication was disabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account"
- },
- {
- "action": "two_factor_authentication.enabled",
- "description": "Two-factor authentication was enabled for a user account.",
- "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.password_reset_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.recovery_codes_regenerated",
- "description": "Two factor recovery codes were regenerated for a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.remove_factor",
- "description": "A secondary authentication factor was removed from a user account.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
- },
- {
- "action": "two_factor_authentication.sign_in_fallback_sms",
- "description": "A one-time password code was sent to a user account fallback phone number.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "two_factor_authentication.update_fallback",
- "description": "The two-factor authentication fallback for a user account was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.add_email",
- "description": "An email address was added to a user account.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account"
- },
- {
- "action": "user.async_delete",
- "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.audit_log_export",
- "description": "Audit log entries were exported.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.block_user",
- "description": "A user was blocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.change_password",
- "description": "A user changed their password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.codespaces_trusted_repo_access_granted",
- "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.codespaces_trusted_repo_access_revoked",
- "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
- "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces"
- },
- {
- "action": "user.create",
- "description": "A new user account was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.create_integration_secret",
- "description": "A user secret for Codespaces was created.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.creation_rate_limit_exceeded",
- "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.delete",
- "description": "A user account was destroyed by an asynchronous job.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.demote",
- "description": "A site administrator was demoted to an ordinary user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.destroy",
- "description": "A user deleted his or her account, triggering user.async_delete.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_failure",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_requested",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.device_verification_success",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.disable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_collaborators_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_contributors_only",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.enable_sockpuppet_disallowed",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.failed_login",
- "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.forgot_password",
- "description": "A user requested a password reset.",
- "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
- },
- {
- "action": "user.grant_github_developer",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.hide_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.login",
- "description": "A user signed in.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.new_device_used",
- "description": "A user signed in from a new device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.promote",
- "description": "An ordinary user account was promoted to a site administrator.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.recreate",
- "description": "A user's account was restored.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_email",
- "description": "An email address was removed from a user account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.remove_integration_secret",
- "description": "A user secret for Codespaces was deleted.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.rename",
- "description": "A username was changed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.reset_password",
- "description": "A user reset their account password.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_session.country_change",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.show_private_contributions_count",
- "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile"
- },
- {
- "action": "user.sign_in_from_unrecognized_device",
- "description": "A user signed in from an unrecognized device.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.sign_in_from_unrecognized_device_and_location",
- "description": "A user signed in from an unrecognized device and location.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.destroy",
- "description": "Triggered when you clear the status on your profile.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user_status.update",
- "description": "Triggered when you set or change the status on your profile.",
- "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status"
- },
- {
- "action": "user.suspend",
- "description": "A user account was suspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.toggle_warn_private_email",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_failure",
- "description": "A 2FA challenge issued for a user account failed.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_challenge_success",
- "description": "A 2FA challenge issued for a user account succeeded.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recover",
- "description": "A user used their 2FA recovery codes.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_downloaded",
- "description": "A user downloaded 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_printed",
- "description": "A user printed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_recovery_codes_viewed",
- "description": "A user viewed 2FA recovery codes for their account.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.two_factor_requested",
- "description": "A user was prompted for a two-factor authentication code.",
- "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
- },
- {
- "action": "user.unblock_user",
- "description": "A user was unblocked by another user.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.unsuspend",
- "description": "A user account was unsuspended.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_integration_secret",
- "description": "A user secret for Codespaces was updated.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "user.update_new_repository_default_branch_setting",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.approve_workflow_job",
- "description": "A workflow job was approved.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- },
- {
- "action": "workflows.bypass_protection_rules",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.comment_workflow_job",
- "description": "N/A",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.delete_workflow_run",
- "description": "A workflow run was deleted.",
- "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run"
- },
- {
- "action": "workflows.disable_workflow",
- "description": "A workflow was disabled.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.enable_workflow",
- "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
- "docs_reference_links": "N/A"
- },
- {
- "action": "workflows.reject_workflow_job",
- "description": "A workflow job was rejected.",
- "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments"
- }
-]
\ No newline at end of file
diff --git a/src/audit-logs/lib/config.json b/src/audit-logs/lib/config.json
index 9a419523fab9..09fb4eddfa22 100644
--- a/src/audit-logs/lib/config.json
+++ b/src/audit-logs/lib/config.json
@@ -9,5 +9,5 @@
"git": "Note: Git events have special access requirements and retention policies that differ from other audit log events. For GitHub Enterprise Cloud, access Git events via the REST API only with 7-day retention. For GitHub Enterprise Server, Git events must be enabled in audit log configuration and are not included in search results.",
"sso_redirect": "Note: Automatically redirecting users to sign in is currently in beta for Enterprise Managed Users and subject to change."
},
- "sha": "af985f404fd4bc6a933c39d75122aad88c1727bc"
+ "sha": "b426a3c9af4b379c4fdd7ee0d59c9db7edb11565"
}
\ No newline at end of file
diff --git a/src/audit-logs/lib/index.ts b/src/audit-logs/lib/index.ts
index 2ffd8aece86f..8538890f844f 100644
--- a/src/audit-logs/lib/index.ts
+++ b/src/audit-logs/lib/index.ts
@@ -3,6 +3,7 @@ import path from 'path'
import { readCompressedJsonFileFallback } from '@/frame/lib/read-json-file'
import { getOpenApiVersion } from '@/versions/lib/all-versions'
import findPage from '@/frame/lib/find-page'
+import type { Context, Page } from '@/types'
import type {
AuditLogEventT,
CategorizedEvents,
@@ -30,11 +31,61 @@ export function getCategoryNotes(): CategoryNotes {
return auditLogConfig.categoryNotes || {}
}
-type TitleResolutionContext = {
- pages: Record
+export type TitleResolutionContext = Context & {
+ pages: Record
redirects: Record
}
+// Resolves docs_reference_links URLs to markdown links
+export async function resolveReferenceLinksToMarkdown(
+ docsReferenceLinks: string,
+ context: TitleResolutionContext,
+): Promise {
+ if (!docsReferenceLinks || docsReferenceLinks === 'N/A') {
+ return ''
+ }
+
+ // Handle multiple comma-separated or space-separated links
+ const links = docsReferenceLinks
+ .split(/[,\s]+/)
+ .map((link) => link.trim())
+ .filter((link) => link && link !== 'N/A')
+
+ const markdownLinks = []
+ for (const link of links) {
+ try {
+ const page = findPage(link, context.pages, context.redirects)
+ if (page) {
+ // Create a minimal context for rendering the title
+ const renderContext = {
+ currentLanguage: 'en',
+ currentVersion: 'free-pro-team@latest',
+ pages: context.pages,
+ redirects: context.redirects,
+ } as unknown as Context
+ const title = await page.renderProp('title', renderContext, { textOnly: true })
+ markdownLinks.push(`[${title}](${link})`)
+ } else {
+ // If we can't resolve the link, use the original URL
+ markdownLinks.push(link)
+ }
+ } catch (error) {
+ // If resolution fails, use the original URL
+ console.warn(
+ `Failed to resolve title for link: ${link}`,
+ error instanceof Error
+ ? error instanceof Error
+ ? error.message
+ : String(error)
+ : String(error),
+ )
+ markdownLinks.push(link)
+ }
+ }
+
+ return markdownLinks.join(', ')
+}
+
// Resolves docs_reference_links URLs to page titles
async function resolveReferenceLinksToTitles(
docsReferenceLinks: string,
@@ -61,7 +112,7 @@ async function resolveReferenceLinksToTitles(
currentVersion: 'free-pro-team@latest',
pages: context.pages,
redirects: context.redirects,
- }
+ } as unknown as Context
const title = await page.renderProp('title', renderContext, { textOnly: true })
titles.push(title)
} else {
diff --git a/src/automated-pipelines/README.md b/src/automated-pipelines/README.md
index 1021cb35ca4d..c7798de6890c 100644
--- a/src/automated-pipelines/README.md
+++ b/src/automated-pipelines/README.md
@@ -53,3 +53,150 @@ Slack: `#docs-engineering`
Repo: `github/docs-engineering`
If you have a question about automation pipelines, you can ask in the `#docs-engineering` Slack channel. If you notice a problem with one of the automation pipelines, you can open an issue in the `github/docs-engineering` repository.
+
+## Sample Pipeline Template
+
+### Basic pipeline structure
+
+```
+src//
+āāā README.md # Pipeline documentation
+āāā scripts/
+ā āāā sync.ts # Main sync script
+āāā data/ # Generated structured data (optional)
+ā āāā fpt/
+ā āāā ghec/
+ā āāā ghes-*/
+āāā lib/ # Utilities and helpers
+āāā components/ # React components (if needed)
+āāā pages/ # Next.js pages (if needed)
+āāā tests/ # Pipeline-specific tests
+### Minimal sync script example
+
+```typescript
+// scripts/sync.ts
+import { Command } from 'commander'
+
+const program = new Command()
+ .description('Sync data')
+ .option('--source-branch ', 'Source repo branch', 'main')
+ .parse()
+
+const opts = program.opts()
+
+async function main() {
+ // 1. Fetch data from external source
+ // 2. Transform data
+ // 3. Write to data/ directory (or generate Markdown)
+ // 4. Validate output
+}
+
+main()
+```
+
+### Workflow example
+
+```yaml
+# .github/workflows/sync-.yml
+name: Sync
+
+on:
+ workflow_dispatch:
+ inputs:
+ SOURCE_BRANCH:
+ description: 'Branch to sync from'
+ default: 'main'
+ schedule:
+ - cron: '16 20 * * *' # Daily
+
+jobs:
+ sync:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+ - run: npm ci
+ - run: npm run sync-
+```
+
+## Ownership Table
+
+| Pipeline | Owning Team | Source Data Owner | Sync Frequency |
+|----------|-------------|-------------------|----------------|
+| REST | Docs Engineering | API Platform | Daily |
+| GraphQL | Docs Engineering | API Platform | Daily |
+| Webhooks | Docs Engineering | API Platform | Daily |
+| CodeQL CLI | Docs Engineering | Code Scanning | Per release |
+| GitHub Apps | Docs Engineering | Integrations | Daily |
+| Audit Logs | Docs Engineering | Enterprise | Daily |
+| Secret Scanning | Docs Engineering | Security | Daily |
+
+## Migration Status
+
+### Active pipelines (ā
Production)
+- REST API - Fully automated, daily sync
+- GraphQL API - Fully automated, daily sync
+- Webhooks - Fully automated, daily sync
+- GitHub Apps - Fully automated, daily sync
+- Secret Scanning - Fully automated, daily sync
+- Audit Logs - Fully automated, daily sync
+
+### Manual sync per release
+- CodeQL CLI - Manual sync per release
+
+### Legacy pipelines (š¦ To migrate)
+- None currently identified
+
+### Migration patterns
+
+When migrating manual content to automated pipelines:
+1. **Audit existing content** - Document current structure
+2. **Source data analysis** - Identify gaps between source and docs
+3. **Data enrichment** - Work with source team to add missing fields
+4. **Scraping phase** - Temporarily scrape existing content to preserve prose
+5. **Gradual migration** - Migrate section by section
+6. **Validation** - Compare old vs new output
+7. **Deprecate manual** - Remove manual content once automated is stable
+
+## Shared Components
+
+Components in `src/automated-pipelines/components/` available for reuse:
+- Parameter tables
+- Response schemas
+- Code example formatting
+- Common layout patterns
+
+## Testing Strategy
+
+### Automated pipeline tests
+
+All autogenerated pages tested in `src/automated-pipelines/tests/rendering.ts`:
+- Page renders without errors
+- Required sections present
+- Links are valid
+- Schema validation
+
+### Pipeline-specific tests
+
+Each pipeline in `src//tests/` should test:
+- Data transformation logic
+- Schema validation
+- Version handling
+- Edge cases specific to that pipeline
+
+### Testing locally
+
+```bash
+# Run all automated pipeline tests
+npm run test -- src/automated-pipelines/tests
+
+# Run specific pipeline tests
+npm run test -- src//tests
+```
+
+We are not expecting significant investment here, but we will add and support pipelines as needed to meet business needs.
+
+### Developer experience
+- Pipeline scaffolding tool
+- Validation helpers
+- Testing fixtures
+- Documentation generator
diff --git a/src/automated-pipelines/components/AutomatedPageContext.tsx b/src/automated-pipelines/components/AutomatedPageContext.tsx
index 50efe899b9f2..7f567ae55cd0 100644
--- a/src/automated-pipelines/components/AutomatedPageContext.tsx
+++ b/src/automated-pipelines/components/AutomatedPageContext.tsx
@@ -1,6 +1,8 @@
import { createContext, useContext } from 'react'
+import type { IncomingMessage } from 'http'
import type { JSX } from 'react'
import type { MiniTocItem } from '@/frame/components/context/ArticleContext'
+import type { Context } from '@/types'
export type AutomatedPageContextT = {
title: string
@@ -25,15 +27,35 @@ export const useAutomatedPageContext = (): AutomatedPageContextT => {
return context
}
-export const getAutomatedPageContextFromRequest = (req: any): AutomatedPageContextT => {
- const page = req.context.page
+type AutomatedPageContextRequest = { context?: Partial } | IncomingMessage
+
+type AutomatedPage = {
+ title: string
+ intro: string
+ product?: string
+ permissions?: string
+ rawPermissions?: string
+}
+
+export const getAutomatedPageContextFromRequest = (
+ req: AutomatedPageContextRequest,
+): AutomatedPageContextT => {
+ const context = 'context' in req ? ((req.context as Partial | undefined) ?? {}) : {}
+ const page = context.page as AutomatedPage | undefined
+
+ if (!page) {
+ throw new Error('"getAutomatedPageContextFromRequest" requires req.context.page')
+ }
+
+ const renderedPage = context.renderedPage ?? ''
+ const miniTocItems = context.miniTocItems ?? []
return {
title: page.title,
intro: page.intro,
- renderedPage: req.context.renderedPage || '',
- miniTocItems: req.context.miniTocItems || [],
- product: page.product || '',
- permissions: page.permissions || '',
+ renderedPage,
+ miniTocItems,
+ product: page.product ?? '',
+ permissions: page.permissions ?? page.rawPermissions ?? '',
}
}
diff --git a/src/automated-pipelines/lib/config.json b/src/automated-pipelines/lib/config.json
index 080034d61d59..376685a92e9d 100644
--- a/src/automated-pipelines/lib/config.json
+++ b/src/automated-pipelines/lib/config.json
@@ -1,9 +1,11 @@
{
"automation-pipelines": [
+ "audit-logs",
"codeql-cli",
"github-apps",
"graphql",
"rest",
+ "secret-scanning",
"webhooks"
]
}
diff --git a/src/automated-pipelines/lib/update-markdown.ts b/src/automated-pipelines/lib/update-markdown.ts
index 7ea72580ef7d..6ca36f482b71 100644
--- a/src/automated-pipelines/lib/update-markdown.ts
+++ b/src/automated-pipelines/lib/update-markdown.ts
@@ -14,7 +14,7 @@ import type { MarkdownFrontmatter } from '@/types'
// Type definitions - extending existing type to add missing fields and make most fields optional
type FrontmatterData = Partial & {
autogenerated?: string
- [key: string]: any
+ [key: string]: unknown
}
type SourceContentItem = {
diff --git a/src/changelogs/README.md b/src/changelogs/README.md
index e69de29bb2d1..eec5e747b43f 100644
--- a/src/changelogs/README.md
+++ b/src/changelogs/README.md
@@ -0,0 +1,67 @@
+# Changelogs (`src/changelogs`)
+
+This directory contains the logic for fetching, parsing, and caching RSS feeds from the GitHub Blog to display changelog items on documentation pages.
+
+## Purpose & Scope
+
+The primary purpose is to provide a "What's New" section on specific documentation pages by pulling the latest updates from relevant GitHub Blog RSS feeds. It handles fetching RSS feeds, caching responses to prevent rate limiting, and parsing feed items for display.
+
+## Architecture & Key Assets
+
+### Core Logic
+
+`lib/changelog.ts` is the main module. It uses `rss-parser` to fetch feeds and implements a two-layer caching strategy:
+
+1. Memory Cache: `globalCache` Map for fast access within the process.
+2. Disk Cache: Writes JSON files to `os.tmpdir()` (or a custom path) to persist across server restarts in development/test environments.
+
+`getChangelogItems` is the public API that returns a list of formatted changelog items.
+
+### Consumers
+
+The middleware `src/frame/middleware/context/whats-new-changelog.ts` uses this library to inject changelog data into the page context (`req.context.whatsNewChangelog`) based on page frontmatter.
+
+Currently, the following product landing pages display a changelog:
+
+- GitHub Actions (`content/actions/index.md`)
+- GitHub Education (`content/education/index.md`)
+- GitHub Enterprise (`content/admin/index.md`)
+- GitHub Packages (`content/packages/index.md`)
+
+## Setup & Usage
+
+### Enabling on a Page
+
+To display a changelog on a documentation page, add the `changelog` property to the page's frontmatter:
+
+```yaml
+changelog:
+ label: packages
+ prefix: "Packages: "
+```
+
+- `label`: Determines the feed URL (e.g., `packages` -> `https://github.blog/changelog/label/packages`).
+- `prefix`: (Optional) A string to strip from the beginning of feed item titles.
+- `versions`: (Optional) Specifies which versions of the docs should display the changelog.
+
+### Environment Variables
+
+- `CHANGELOG_DISABLED`: Set to `true` to disable fetching (returns undefined). This is often necessary in tests where external network requests are flaky or blocked.
+- `CHANGELOG_CACHE_FILE_PATH`: (Optional) Override the default disk cache location.
+
+## Data & External Dependencies
+
+- Source: [GitHub Blog](https://github.blog) RSS feeds (e.g., `https://github.blog/changelog/label/packages/feed`).
+- Dependencies: `rss-parser` is used to parse the XML RSS feeds.
+
+## Cross-links & Ownership
+
+- **Owner**: Docs Engineering owns this code. Marketing Engineering owns the GitHub Blog and its feeds.
+- **Related Directories**:
+ - `src/frame/middleware/context`: Contains the middleware that invokes this logic.
+ - `src/changelogs/tests`: Contains tests for this module.
+
+## Current State & Next Steps
+
+- **Current State**: The system is stable and considered KTLO (Keep the Lights On). It fetches the latest 3 items from the specified feed.
+- **Next Steps**: None planned.
diff --git a/src/code-scanning/README.md b/src/code-scanning/README.md
deleted file mode 100644
index 2dbadbf1306d..000000000000
--- a/src/code-scanning/README.md
+++ /dev/null
@@ -1,64 +0,0 @@
-# Code scanning query tables
-
-This nascent pipeline creates autogenerated documentation docs.github.com from the query suites included with the [CodeQL bundle](https://github.com/github/codeql-action/releases).
-
-The pipeline is used to generate Markdown tables that are stored in reusable files and used in article pages on the docs.github.com site.
-
-## How does it work
-
-```mermaid
----
-title: "Process for generating Code scanning query tables"
----
-flowchart TB
-
-accDescr: A flow chart describing how the automation generates documentation for code scanning queries.
-
- start([Start]) --> checkout[Checkout the codeql repository]
- start --- download[Download the CodeQL CLI]
- checkout --- query-suites[fa:fa-file Query suites *.qls]
- query-suites ---> generate[Generate tables:src/code-scanning/scripts/generate-code-scanning-query-lists.ts]
- download --- codeql-cli[CodeQL CLI: codeql.exe]
- codeql-cli --> generate
- generate --- markdown[fa:fa-file Reusable files *.md]
- markdown --> pr[Generate a PR overwriting:data/reusables/code-scanning/codeql-query-tables/*.md]
- pr --> finish([End])
-
-%% Define styles
- classDef start fill:#1AAC9D, color:white
- classDef action fill:#6557F6, color:white
- classDef finish fill:#F8C324, color:white
- classDef file fill:#ddd
-
-%% Assign styles
- class start start;
- class finish finish;
- class checkout,download,generate,pr action;
- class markdown,query-suites,codeql-cli file;
-```
-
-A [workflow](.github/workflows/generate-code-scanning-query-lists.yml) is used to trigger the automation of the code scanning query tables documentation. The workflow is manually triggered by a member of the GitHub Docs team approximately every two weeks to align to releases of the CodeQL CLI. The workflow takes an input parameter that specifies the branch to pull the source files from in the semmle-code repo. If the branch input is omitted, the workflow will default to the `main` branch.
-
-The workflow runs the `npm run generate-code-scanning-query-list` script, which generates Markdown files under `data/reusables/code-scanning/codeql-query-tables`.
-
-The workflow automatically creates a new pull request with the changes and the label `codeql-query-tables`.
-
-## Local development
-
-To run the pipeline locally, see the comments in the [script](scripts/generate-code-scanning-query-list.ts).
-
-## Content team
-
-The content writers can use the reusables in any content article. They have no need to make any changes to the script unless additional built-in query suites are added.
-
-## How to get help
-
-### For workflow and script problems
-
-Slack: `#docs-engineering`
-Repo: `github/docs-engineering`
-
-### For CodeQL repository and CLI problems
-
-Slack: `#code-scanning-internal-dx`
-Repo: `github/code-scanning-internal-dx-team`
diff --git a/src/code-scanning/scripts/tsconfig.json b/src/code-scanning/scripts/tsconfig.json
deleted file mode 100644
index 11ddf7df116a..000000000000
--- a/src/code-scanning/scripts/tsconfig.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
- "extends": "../../../tsconfig.json",
- "include": ["generate-code-scanning-query-list.ts"],
- "exclude": ["node_modules"]
-}
diff --git a/src/codeql-cli/README.md b/src/codeql-cli/README.md
index 2129efd84d65..27f61a164e3e 100644
--- a/src/codeql-cli/README.md
+++ b/src/codeql-cli/README.md
@@ -46,3 +46,79 @@ Slack: `#docs-engineering`
Repo: `github/docs-engineering`
If you have a question about the CodeQL CLI pipeline, you can ask in the `#docs-engineering` Slack channel. If you notice a problem with the CodeQL CLI pipeline, you can open an issue in the `github/docs-engineering` repository.
+
+## Dependency Matrix
+
+### Required dependencies
+
+| Dependency | Purpose | Installation | Notes |
+|------------|---------|--------------|-------|
+| **Pandoc** | Convert ReStructuredText to Markdown | `brew install pandoc` (macOS) | Version 2.x+ required |
+| **semmle-code repo** | Source ReStructuredText files | Clone at root of docs-internal | Private GitHub repo |
+| **Node.js** | Run sync script | Already in project | Version specified in `.nvmrc` |
+
+### Source data location
+- **Repository**: `github/semmle-code` (private)
+- **Branch**: Configurable (default: `main`)
+- **Source files**: ReStructuredText documentation in semmle-code
+- **Output location**: `content/code-security/codeql-cli/codeql-cli-manual/`
+
+### Version compatibility
+- CodeQL CLI releases approximately every 2 weeks
+- Pipeline should be run to align with CLI releases
+- Multiple CLI versions may be documented simultaneously
+
+## Escalation Policy
+
+### Ownership
+- **Team**: Docs Engineering
+- **Source team**: Code Security (CodeQL team)
+
+### Escalation path
+1. **Pipeline failures** ā #docs-engineering Slack
+2. **Source data issues** ā #code-security-docs Slack
+3. **Pandoc conversion issues** ā Check Pandoc version and file format
+4. **Repo access issues** ā Request access to `github/semmle-code`
+
+### On-call procedures
+If the pipeline fails:
+1. Check workflow logs for errors
+2. Verify Pandoc is installed and working
+3. Confirm access to `semmle-code` repo
+4. Check for ReStructuredText format changes
+5. Test conversion locally before re-running
+6. Escalate to Code Security team if source data issue
+
+### Common failure modes
+- **Pandoc not found** - Install Pandoc locally or in CI
+- **semmle-code not cloned** - Clone repo at docs-internal root
+- **Conversion errors** - Check for unsupported RST syntax
+- **Branch not found** - Verify branch name in workflow input
+
+## Known Constraints
+
+### Pipeline limitations
+- **Manual trigger only** - No automated schedule (runs on-demand)
+- **Pandoc dependency** - Requires external tool installation
+- **Repo access** - Requires access to private `semmle-code` repo
+- **Local testing** - Must clone semmle-code locally to test
+
+### Content constraints
+- **Frontmatter preservation** - Only first sync sets frontmatter
+- **Introduction placement** - Must be above auto-generation comment
+- **No inline editing** - Cannot edit autogenerated sections
+- **Version handling** - Limited liquid versioning support
+
+### Technical constraints
+- **ReStructuredText format** - Source must be valid RST
+- **Pandoc conversion** - Limited control over conversion output
+- **File naming** - Determined by source file structure
+- **Link rewriting** - May need manual adjustment after generation
+
+### Process constraints
+- **Release alignment** - Sync timing depends on CodeQL releases
+- **PR review required** - Changes must be reviewed before merge
+- **Content coordination** - Writers must coordinate intro additions
+- **Multiple versions** - May need separate syncs for version branches
+
+We are not expecting significant new work to this pipeline, but we will support incoming changes from semmle-code.
diff --git a/src/codeql-cli/lib/config.json b/src/codeql-cli/lib/config.json
index dd6f8c49c67d..d62f6633ffe9 100644
--- a/src/codeql-cli/lib/config.json
+++ b/src/codeql-cli/lib/config.json
@@ -15,8 +15,8 @@
"autogenerated": "codeql-cli"
},
"markdownPrefix": "{% data reusables.codeql-cli.man-pages-version-note %}",
- "targetDirectory": "content/code-security/codeql-cli/codeql-cli-manual",
+ "targetDirectory": "content/code-security/reference/code-scanning/codeql/codeql-cli-manual",
"sourceDirectory": "semmle-code/documentation/restructuredtext/codeql-cli/manual",
"removeKeywords": [],
- "linterIgnore": ["content/code-security/codeql-cli/codeql-cli-manual"]
+ "linterIgnore": ["content/code-security/reference/code-scanning/codeql/codeql-cli-manual"]
}
diff --git a/src/codeql-cli/scripts/sync.ts b/src/codeql-cli/scripts/sync.ts
index 7ca45f732e7b..d7a273980178 100755
--- a/src/codeql-cli/scripts/sync.ts
+++ b/src/codeql-cli/scripts/sync.ts
@@ -29,7 +29,7 @@ async function main() {
includeBasePath: true,
globs: ['**/*.md'],
})
- const cliMarkdownContents: Record = {}
+ const cliMarkdownContents: Record; content: string }> = {}
for (const file of markdownFiles) {
const sourceContent = await readFile(file, 'utf8')
diff --git a/src/codeql-queries/README.md b/src/codeql-queries/README.md
new file mode 100644
index 000000000000..5bf9bd0f092b
--- /dev/null
+++ b/src/codeql-queries/README.md
@@ -0,0 +1,88 @@
+# CodeQL query tables
+
+This pipeline creates autogenerated documentation for docs.github.com from the query suites included with the [CodeQL bundle](https://github.com/github/codeql-action/releases).
+
+The pipeline generates Markdown tables that are stored in reusable files and used in article pages on the docs.github.com site.
+
+There are two types of query table generators:
+
+1. **Security queries** (`generate-code-scanning-query-list.ts`) - generates tables for security-related queries from the `code-scanning` and `security-extended` suites, including CWE information and autofix support.
+2. **Code quality queries** (`generate-code-quality-query-list.ts`) - generates tables for code quality queries from the `code-quality` suite, showing query categories (reliability, maintainability).
+
+## How does it work
+
+```mermaid
+---
+title: "Process for generating CodeQL query tables"
+---
+flowchart TB
+
+accDescr: A flow chart describing how the automation generates documentation for CodeQL queries.
+
+ start([Start]) --> checkout[Checkout the codeql repository]
+ start --> download[Download the CodeQL CLI]
+
+ checkout --> security-suites[fa:fa-file Security query suites *.qls]
+ checkout --> quality-suites[fa:fa-file Quality query suites *.qls]
+
+ security-suites --> generate-security[Generate security tables]
+ quality-suites --> generate-quality[Generate quality tables]
+
+ download --> codeql-cli[CodeQL CLI: codeql.exe]
+ codeql-cli --> generate-security
+ codeql-cli --> generate-quality
+
+ generate-security --> security-markdown[fa:fa-file Security reusables *.md]
+ generate-quality --> quality-markdown[fa:fa-file Quality reusables *.md]
+
+ security-markdown --> merge[Merge artifacts]
+ quality-markdown --> merge
+
+ merge --> pr[Generate a PR with both:
data/reusables/code-scanning/codeql-query-tables/*.md
data/reusables/code-quality/codeql-query-tables/*.md]
+ pr --> finish([End])
+
+%% Define styles
+ classDef start fill:#1AAC9D, color:white
+ classDef action fill:#6557F6, color:white
+ classDef finish fill:#F8C324, color:white
+ classDef file fill:#ddd
+
+%% Assign styles
+ class start start;
+ class finish finish;
+ class checkout,download,generate-security,generate-quality,merge,pr action;
+ class security-markdown,quality-markdown,security-suites,quality-suites,codeql-cli file;
+```
+
+A [workflow](../../.github/workflows/generate-codeql-query-lists.yml) is used to trigger the automation of the CodeQL query tables documentation. The workflow is manually triggered by a member of the GitHub Docs team approximately every two weeks to align to releases of the CodeQL CLI. The workflow takes an input parameter that specifies the branch to pull the source files from in the codeql repo. If the branch input is omitted, the workflow will default to the `main` branch.
+
+The workflow runs two scripts in parallel:
+- `npm run generate-code-scanning-query-list` - generates security query tables under `data/reusables/code-scanning/codeql-query-tables/`
+- `npm run generate-code-quality-query-list` - generates code quality query tables under `data/reusables/code-quality/codeql-query-tables/`
+
+The workflow automatically creates a new pull request with changes from both scripts and the label `codeql-query-tables`.
+
+## Local development
+
+To run the pipeline locally, see the comments in the scripts:
+- Security queries: [generate-code-scanning-query-list.ts](scripts/generate-code-scanning-query-list.ts)
+- Code quality queries: [generate-code-quality-query-list.ts](scripts/generate-code-quality-query-list.ts)
+
+## Content team
+
+The content writers can use the reusables in any content article. They have no need to make any changes to the scripts unless additional built-in query suites are added.
+
+For security queries, reusables are stored in `data/reusables/code-scanning/codeql-query-tables/`.
+For code quality queries, reusables are stored in `data/reusables/code-quality/codeql-query-tables/`.
+
+## How to get help
+
+### For workflow and script problems
+
+Slack: `#docs-engineering`
+Repo: `github/docs-engineering`
+
+### For CodeQL repository and CLI problems
+
+Slack: `#code-scanning-engine-quality`
+Repo: `github/code-scanning-engine-quality-team`
diff --git a/src/codeql-queries/scripts/generate-code-quality-query-list.ts b/src/codeql-queries/scripts/generate-code-quality-query-list.ts
new file mode 100644
index 000000000000..a0348201000a
--- /dev/null
+++ b/src/codeql-queries/scripts/generate-code-quality-query-list.ts
@@ -0,0 +1,291 @@
+/**
+ * This script generates a block of Markdown that can be saved as a reusable.
+ * The reusable lists all the code quality queries for one programming language, with categories, as a Markdown table.
+ *
+ * To be able to execute this script, you need to have the CodeQL CLI installed.
+ * To do that, you need two things:
+ *
+ * 1. The directory where the github/codeql repo is cloned
+ * 2. The path to the executable `codeql` file.
+ *
+ * The directory where the github/codeql repo is cloned is needed because
+ * that's how it looks up files. You can set it up like this:
+ *
+ * cd /tmp
+ * git clone git@github.com:github/codeql.git
+ * cd codeql
+ * pwd
+ *
+ * To install the codeql executable, use `gh` like this:
+ *
+ * gh extension install github/gh-codeql
+ * gh codeql set-channel nightly
+ * gh codeql version
+ *
+ * Note that when you run the `gh codeql version` command, it will tell you
+ * where the executable is installed. For example:
+ *
+ * /Users/peterbe/.local/share/gh/extensions/gh-codeql/dist/nightly/codeql-bundle-20231204/codeql
+ *
+ * If you've git cloned github/codeql in /tmp/ now you can execute this script.
+ * For example, to generate the Markdown
+ * for Python:
+ *
+ * npm run generate-code-quality-query-list -- \
+ * --codeql-path ~/.local/share/gh/extensions/gh-codeql/dist/nightly/codeql-bundle-20231204/codeql \
+ * --codeql-dir /tmp/codeql python | tee /tmp/python.md
+ * less /tmp/python.md
+ */
+
+import fs from 'fs'
+import { execFileSync } from 'child_process'
+
+import chalk from 'chalk'
+import { program } from 'commander'
+
+program
+ .description('Generate a reusable Markdown for code quality queries by language')
+ .option('--verbose', 'Verbose outputs')
+ .option('--codeql-path ', 'path to the codeql executable', 'codeql')
+ .option('--codeql-dir ', 'path to the codeql executable', '.codeql/')
+ .option('-o, --output-file ', 'output file path (default: stdout)', 'stdout')
+ .argument('', 'for example java')
+ .parse(process.argv)
+
+type Options = {
+ codeqlPath: string
+ codeqlDir: string
+ outputFile: string
+ verbose: boolean
+}
+
+type QueryMetadata = {
+ id?: string
+ name?: string
+ tags?: string
+ severity?: string
+ problem?: {
+ severity?: string
+ }
+}
+
+type Query = {
+ name: string
+ url: string
+ categories: string[]
+ severity: string
+}
+
+type QueryExtended = Query & {
+ primaryCategory: string
+}
+
+const opts = program.opts()
+main(
+ {
+ codeqlPath: opts.codeqlPath,
+ codeqlDir: opts.codeqlDir,
+ outputFile: opts.outputFile,
+ verbose: Boolean(opts.verbose),
+ },
+ program.args[0],
+)
+
+async function main(options: Options, language: string) {
+ if (options.verbose && options.outputFile === 'stdout') {
+ console.warn(chalk.yellow('Verbose mode is on but output is going to stdout'))
+ }
+
+ if (!testCodeQLPath(options)) {
+ process.exit(1)
+ }
+
+ const queries: {
+ [id: string]: Query
+ } = {}
+
+ const languagePack = `${language}-code-quality.qls`
+ if (options.verbose) console.log(chalk.dim(`Searching for queries in ${languagePack}`))
+ const res = execFileSync(
+ options.codeqlPath,
+ ['resolve', 'queries', `--search-path=${options.codeqlDir}`, languagePack],
+ {
+ encoding: 'utf-8',
+ },
+ )
+ for (const line of res.split('\n')) {
+ if (line.trim()) {
+ if (options.verbose) console.log('found', line)
+ const metadata = getMetadata(options, line)
+ const { id, name, tags, severity } = metadata
+ if (id && name) {
+ const categories = getCategories(tags || '')
+ const url = getDocsLink(language, id)
+
+ // Only include queries that have categories
+ if (categories.length) {
+ queries[id] = { url, name, categories, severity: severity || 'N/A' }
+ } else {
+ if (options.verbose) {
+ console.log(chalk.dim(`Skipping ${id} because it has no categories`))
+ }
+ }
+ }
+ }
+ }
+
+ function decorate(query: Query): QueryExtended {
+ // Determine primary category for sorting
+ // Prefer 'maintainability' over 'reliability'
+ const primaryCategory = query.categories.includes('maintainability')
+ ? 'maintainability'
+ : query.categories.includes('reliability')
+ ? 'reliability'
+ : query.categories[0] || ''
+
+ return {
+ ...query,
+ primaryCategory,
+ }
+ }
+
+ const entries = Object.values(queries).map(decorate)
+
+ // Sort by primary category (maintainability first), then alphabetically by name
+ entries.sort((a, b) => {
+ if (a.primaryCategory === 'maintainability' && b.primaryCategory !== 'maintainability')
+ return -1
+ else if (a.primaryCategory !== 'maintainability' && b.primaryCategory === 'maintainability')
+ return 1
+
+ if (a.primaryCategory === 'reliability' && b.primaryCategory !== 'reliability') return -1
+ else if (a.primaryCategory !== 'reliability' && b.primaryCategory === 'reliability') return 1
+
+ return a.name.localeCompare(b.name)
+ })
+
+ printQueries(options, entries)
+}
+
+function printQueries(options: Options, queries: QueryExtended[]) {
+ const markdown: string[] = []
+ markdown.push('{% rowheaders %}')
+ markdown.push('') // blank line
+ const header = ['Query name', 'Category', 'Severity']
+ markdown.push(`| ${header.join(' | ')} |`)
+ markdown.push(`| ${header.map(() => '---').join(' | ')} |`)
+
+ for (const query of queries) {
+ const markdownLink = `[${query.name}](${query.url})`
+ // Capitalize first letter of category for display
+ const categoryDisplay = query.categories
+ .map((cat) => cat.charAt(0).toUpperCase() + cat.slice(1))
+ .join(', ')
+ // Capitalize first letter of severity for display
+ const severityDisplay = query.severity.charAt(0).toUpperCase() + query.severity.slice(1)
+ const row = [markdownLink, categoryDisplay, severityDisplay]
+ markdown.push(`| ${row.join(' | ')} |`)
+ }
+ markdown.push('') // blank line
+ markdown.push('{% endrowheaders %}')
+ markdown.push('') // always end with a blank line
+
+ if (options.outputFile === 'stdout') {
+ console.log(markdown.join('\n'))
+ } else {
+ fs.writeFileSync(options.outputFile, markdown.join('\n'), 'utf-8')
+ }
+}
+
+function getMetadata(options: Options, queryFile: string): QueryMetadata {
+ const metadataJson = execFileSync(options.codeqlPath, ['resolve', 'metadata', queryFile], {
+ encoding: 'utf-8',
+ })
+ const parsed = JSON.parse(metadataJson)
+
+ // Extract severity from various possible locations in the metadata
+ // CodeQL metadata can have @problem.severity in the query file, which may be
+ // represented in different ways in the JSON output from `codeql resolve metadata`
+ const severity =
+ parsed.problem?.severity || // Nested: { problem: { severity: "error" } }
+ parsed['@problem']?.severity || // Nested with @: { "@problem": { severity: "error" } }
+ parsed['@problem.severity'] || // Direct key: { "@problem.severity": "error" }
+ parsed['problem.severity'] || // Direct key without @: { "problem.severity": "error" }
+ parsed.severity || // Simple: { severity: "error" }
+ parsed['@severity'] // With @: { "@severity": "error" }
+
+ if (options.verbose) {
+ // On first query only, show all available keys to help debug
+ if (!getMetadata.shownKeys) {
+ console.log(chalk.yellow('Available metadata keys:'), Object.keys(parsed))
+ if (parsed.problem) {
+ console.log(chalk.yellow('Available problem keys:'), Object.keys(parsed.problem))
+ }
+ if (parsed['@problem']) {
+ console.log(chalk.yellow('Available @problem keys:'), Object.keys(parsed['@problem']))
+ }
+ getMetadata.shownKeys = true
+ }
+ if (severity) {
+ console.log(chalk.dim(`Query ${parsed.id} has severity: ${severity}`))
+ } else {
+ console.log(chalk.red(`Query ${parsed.id} has NO severity found`))
+ console.log(chalk.red('Available keys for this query:'), Object.keys(parsed))
+ }
+ }
+
+ return {
+ ...parsed,
+ severity,
+ }
+}
+
+// Add a property to track if we've shown keys
+getMetadata.shownKeys = false
+
+/**
+ *
+ * @param language 'cpp'
+ * @param queryId 'external-entity-expansion'
+ * @returns https://codeql.github.com/codeql-query-help/cpp/cpp-external-entity-expansion/
+ */
+function getDocsLink(language: string, queryId: string) {
+ return `https://codeql.github.com/codeql-query-help/${language}/${queryId.replaceAll('/', '-')}/`
+}
+
+/**
+ *
+ * @param tags 'maintainability readability reliability external/cwe/cwe-1078 external/cwe/cwe-670 security'
+ * @returns ['maintainability', 'reliability']
+ */
+function getCategories(tags: string) {
+ const categories: string[] = []
+ for (const tag of tags.split(/\s+/g)) {
+ if (tag === 'maintainability' || tag === 'reliability') {
+ categories.push(tag)
+ }
+ }
+ return categories
+}
+
+function testCodeQLPath(options: Options) {
+ try {
+ const output = execFileSync(options.codeqlPath, ['--version'], { encoding: 'utf-8' })
+ if (options.verbose) {
+ const matched = output.match(/CodeQL command-line toolchain release ([\d.+]+)/)
+ if (matched) {
+ console.log('codeql version', chalk.green(matched[0]))
+ return true
+ }
+ }
+ return true
+ } catch (error) {
+ console.error('Could not find codeql executable at', options.codeqlPath)
+ if (options.verbose) {
+ throw error
+ } else {
+ console.log(chalk.yellow(`${options.codeqlPath} --version`), 'failed')
+ return false
+ }
+ }
+}
diff --git a/src/code-scanning/scripts/generate-code-scanning-query-list.ts b/src/codeql-queries/scripts/generate-code-scanning-query-list.ts
similarity index 98%
rename from src/code-scanning/scripts/generate-code-scanning-query-list.ts
rename to src/codeql-queries/scripts/generate-code-scanning-query-list.ts
index d02e6e311439..8dfa75149b2c 100644
--- a/src/code-scanning/scripts/generate-code-scanning-query-list.ts
+++ b/src/codeql-queries/scripts/generate-code-scanning-query-list.ts
@@ -53,7 +53,8 @@ import chalk from 'chalk'
import { program } from 'commander'
// We don't want to introduce a global dependency on @github/cocofix, so we install it by hand
// as described above and suppress the import warning.
-import { getSupportedQueries } from '@github/cocofix/dist/querySuites' /* eslint-disable-line import/no-extraneous-dependencies, import/no-unresolved */
+// eslint-disable-next-line import/no-unresolved -- @github/cocofix is installed manually
+import { getSupportedQueries } from '@github/cocofix/dist/querySuites'
import type { Language } from 'codeql-ts'
program
diff --git a/src/codeql-queries/scripts/tsconfig.json b/src/codeql-queries/scripts/tsconfig.json
new file mode 100644
index 000000000000..ebbc6a4ae1d3
--- /dev/null
+++ b/src/codeql-queries/scripts/tsconfig.json
@@ -0,0 +1,5 @@
+{
+ "extends": "../../../tsconfig.json",
+ "include": ["generate-code-scanning-query-list.ts", "generate-code-quality-query-list.ts"],
+ "exclude": ["node_modules"]
+}
diff --git a/src/color-schemes/README.md b/src/color-schemes/README.md
index 11824222f55a..54a41ac2a914 100644
--- a/src/color-schemes/README.md
+++ b/src/color-schemes/README.md
@@ -1,5 +1,72 @@
-# Color schemes
+# Color Schemes
-Color schemes are user preferences regarding which type of colors they would like the site to use. Currently we support a number of mode, including light, dark, and several accessibility options.
+This module manages the application of color themes (light, dark, high contrast, etc.) to the GitHub Docs site. It ensures that the documentation matches the user's preferred color scheme as configured on GitHub.com.
-We chose the name "schemes" instead of modes or themes because that is what the HTML specification calls them.
+## Purpose & Scope
+
+The primary goal is to read the user's color preference from a cookie and apply the correct theme context to the React application. This supports:
+- **Modes**: Light, Dark, Auto (system preference).
+- **Themes**: Specific variations like "Dark Dimmed" or "Dark High Contrast".
+- **Compatibility**: Bridging the gap between raw CSS class names and Primer React component props.
+
+## Architecture
+
+The core logic is contained within `src/color-schemes/components/useTheme.ts`.
+
+### The `color_mode` Cookie
+
+The site relies on a cookie named `color_mode` to determine the user's preference. This cookie is typically set by the main GitHub application and shared with the docs subdomains. The cookie value is a JSON string containing:
+- `color_mode`: The overall mode (`light`, `dark`, `auto`).
+- `light_theme`: The specific theme to use when in light mode.
+- `dark_theme`: The specific theme to use when in dark mode.
+
+### `useTheme` Hook
+
+The `useTheme` hook is the main entry point. It performs the following steps:
+1. **Reads the Cookie**: Parses the `color_mode` cookie safely.
+2. **Normalizes Data**: Validates the values against supported enums (`SupportedTheme`, `CssColorMode`).
+3. **Formats for Consumers**: Returns two distinct theme objects:
+ - `css`: For applying global CSS classes (uses `light`/`dark`).
+ - `component`: For passing to Primer React's `ThemeProvider` (uses `day`/`night`).
+
+### Mapping Logic
+
+Primer React uses slightly different terminology than the underlying CSS or the cookie schema. The module handles this translation:
+- CSS `light` -> Component `day`
+- CSS `dark` -> Component `night`
+
+## Setup & Usage
+
+To access the current theme in a component:
+
+```typescript
+import { useTheme } from '@/color-schemes/components/useTheme'
+
+const MyComponent = () => {
+ const { theme } = useTheme()
+
+ // Access CSS-friendly values
+ console.log(theme.css.colorMode)
+
+ // Access Primer-friendly values
+ console.log(theme.component.dayScheme)
+}
+```
+
+This hook is primarily used at the root of the application (e.g., in `src/frame/components/Page.tsx` or `_app.tsx`) to wrap the content in a `ThemeProvider`.
+
+## Dependencies
+
+- **`js-cookie`**: Used via `src/frame/components/lib/cookies` to read the browser cookie.
+- **Primer React**: The output format is specifically designed to satisfy Primer React's theming requirements.
+
+## Ownership
+
+- **Team**: `@github/docs-engineering`
+
+## Current State & Known Issues
+
+- **Hydration Mismatch / Flash of Unstyled Content**: Since the theme is read from a cookie on the client side (in `useEffect`), there can be a brief moment where the default theme is applied before the user's preference loads.
+- **Race Condition Workaround**: There is a `setTimeout` hack in `useTheme.ts` to delay the theme application. This is necessary to prevent Primer React's internal logic from overriding the user's preference with `auto` on initial load.
+ - *Reference*: [Primer React Issue #2229](https://github.com/primer/react/issues/2229)
+- **Future**: The long-term goal is to rely entirely on CSS variables, removing the need for complex JavaScript state management for theming.
\ No newline at end of file
diff --git a/src/content-linter/lib/helpers/get-rules.ts b/src/content-linter/lib/helpers/get-rules.ts
index c06c2c711495..a27587067fc0 100644
--- a/src/content-linter/lib/helpers/get-rules.ts
+++ b/src/content-linter/lib/helpers/get-rules.ts
@@ -1,11 +1,11 @@
import { gitHubDocsMarkdownlint } from '@/content-linter/lib/linting-rules/index'
import { baseConfig } from '@/content-linter/style/base'
import { customConfig } from '@/content-linter/style/github-docs'
-import type { Rule } from '@/content-linter/types'
+import type { Rule, RuleConfig } from '@/content-linter/types'
// Import markdownlint rules - external library without TypeScript declarations
import markdownlintRules from '../../../../node_modules/markdownlint/lib/rules'
export const customRules: Rule[] = gitHubDocsMarkdownlint.rules
-export const allRules: any[] = [...markdownlintRules, ...gitHubDocsMarkdownlint.rules]
-export const allConfig: Record